Jtdcftul

After a update to 18.4 i cannot use ssl anymore. I can still load the page with firefox.

Example 1:

openssl s_client -connect www.python.org:443 -tls1_2

CONNECTED(00000003)

140370126008768:error:141B306E:SSL routines:tls_collect_extensions:bad            extension:ssl/statem/extensions.c:391:

---

no peer certificate available

---

No client certificate CA names sent

---

SSL handshake has read 70 bytes and written 183 bytes

Verification: OK

---

New, (NONE), Cipher is (NONE)

Secure Renegotiation IS NOT supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

Protocol  : TLSv1.2

Cipher    : 0000

Session-ID: 

Session-ID-ctx: 

Master-Key: 

PSK identity: None

PSK identity hint: None

SRP username: None

Start Time: 1533142828

Timeout   : 7200 (sec)

Verify return code: 0 (ok)

Extended master secret: no

---

Example 2:

curl https://pypi.org -v

* Rebuilt URL to: https://pypi.org/

*   Trying 2a04:4e42:600::223...

* TCP_NODELAY set

* Connected to pypi.org (2a04:4e42:600::223) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* successfully set certificate verify locations:

*   CAfile: /etc/ssl/certs/ca-certificates.crt

  CApath: /etc/ssl/certs

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (OUT), TLS alert, Server hello (2):

* error:141B306E:SSL routines:tls_collect_extensions:bad extension

* stopped the pause stream!

* Closing connection 0

curl: (35) error:141B306E:SSL routines:tls_collect_extensions:bad extension

My openssl version:

 OpenSSL 1.1.0g  2 Nov 2017 (Library: OpenSSL 1.1.1-dev  xx XXX xxxx)

built on: reproducible build, date unspecified

platform: linux-x86_64

compiler: gcc -DDSO_DLFCN -DHAVE_DLFCN_H -DNDEBUG -DOPENSSL_THREADS -DOPENSSL_NO_STATIC_ENGINE -DOPENSSL_PIC -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DOPENSSLDIR=""/usr/local/ssl"" -DENGINESDIR=""/usr/local/lib/engines-1.1""  -Wa,--noexecstack

OPENSSLDIR: "/usr/local/ssl"

ENGINESDIR: "/usr/local/lib/engines-1.1"

I tried to reinstall openssl and update the ca-certificates.
What else could i try?

I hope you can help me.

I face a similar problem:

   curl https://pypi.org -v

    * Rebuilt URL to: https://pypi.org/

    *   Trying 2a04:4e42:400::223...

    * TCP_NODELAY set

    * Connected to pypi.org (2a04:4e42:400::223) port 443 (#0)

    * ALPN, offering h2

    * ALPN, offering http/1.1

    * successfully set certificate verify locations:

    *   CAfile: /etc/ssl/certs/ca-certificates.crt

      CApath: /etc/ssl/certs

    * TLSv1.2 (OUT), TLS handshake, Client hello (1):

    * TLSv1.2 (IN), TLS handshake, Server hello (2):

    * TLSv1.2 (IN), TLS handshake, Certificate (11):

    * TLSv1.2 (IN), TLS handshake, Server key exchange (12):

    * TLSv1.2 (IN), TLS handshake, Server finished (14):

    * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

    * TLSv1.2 (OUT), TLS change cipher, Client hello (1):

    * TLSv1.2 (OUT), TLS handshake, Finished (20):

    * OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to pypi.org:443 

    * stopped the pause stream!

    * Closing connection 0

    curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to pypi.org:443 



OpenSSL 1.1.0g  2 Nov 2017



ldd /usr/bin/openssl

    linux-vdso.so.1 (0x00007ffc517f7000)

    libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f9d2ba51000)

    libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f9d2b5d9000)

    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f9d2b3ba000)

    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9d2afc9000)

    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f9d2adc5000)

    /lib64/ld-linux-x86-64.so.2 (0x00007f9d2bf5c000)

echo $LD_LIBRARY_PATH return an empty line

pip 19.1 from /usr/local/lib/python2.7/dist-packages/pip (python 2.7)

pip 19.1 from /usr/local/lib/python3.6/dist-packages/pip (python 3.6)