Home / server / Questions / 405608
In Process
Isaac Kwan
Asked: 2012-07-07 20:46:14 +0800 CST

Does software utilizing OpenSSL needs to be specially compiled for ECDSA support?

  • 772

I am attempting to configure my Apache Traffic Server to use ECDSA cert/key. However, I got the following error message when connecting with openssl s_client

 routines:SSL23_GET_SERVER_HELLO:sslv 3 alert handshake

and if I attempt to connect it directly with Firefox I am prompted that no common cipher is available.

I am pretty sure that the certs/keys are generated correctly as I was able to establish a connection with the same cert/key with openssl s_server and openssl s_client.

So that makes me wondering if I need to compile ATS specially to make use of ECDSA certificates.

ssl openssl apache-traffic-server

1 Answers

  1. Sounds like yes.

    A quick Googling turns out this post which pointed out that "this requires elliptic curve to be specified to use for ephemeral ECDH keys" and thus if you are going to use a ECDSA, you will need the software to specially support it.

    • 1