Member Avatar for person

Hi all,

My problem is I can't access web pages by IE6.0.29 when server uses the DES-CBC-SHA or other(DES or DES3) cipher suits.
But the firefox work well.:eek: (good fox).

The server is worked with stunnel-4.15 and openssl-0.9.8b.
I just enabled the DES-CBC-SHA cipher(I had already tried other cipher suits too). I found only RC4 cipher suits are ok. Is any wrong configuration with my server? or the IE?:?:
Best regards,
Person

  • 2 Contributors
  • 2 Replies
  • 1K Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by person

Dani AI

Generated

your RC4-only observation is the tell. OpenSSL inserts an empty TLS record as a CBC workaround; some older Microsoft TLS stacks (IE6/SChannel) choke on that extra empty fragment, which is why CBC suites like DES-CBC-SHA or 3DES fail while RC4 (not CBC) still works. Disabling the fragment insertion fixes IE6 without changing your cipher list, which is exactly what pointed you to. (docs.openssl.org)

If you are using stunnel, add the OpenSSL option in stunnel.conf, reload, and then verify:

; stunnel.conf (server side)
options = DONT_INSERT_EMPTY_FRAGMENTS

; quick check from a client box
openssl s_client -connect your.host:443 -tls1 -cipher 'DES-CBC-SHA'

The options = DONT_INSERT_EMPTY_FRAGMENTS directive maps to OpenSSL’s SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS and is present specifically for interoperability with broken clients. After a restart, IE6 should negotiate CBC suites again. (manpagez.com)

Two cautions for anyone discovering this thread later: disabling empty fragments removes a CBC hardening measure that was added to mitigate known TLS 1.0 issues, and the stream cipher you found working (RC4) has since been prohibited in TLS. If you do not need to support IE6-era clients anymore, prefer modern TLS (1.2/1.3) and AEAD suites instead of DES/3DES/RC4. (docs.openssl.org)

Member Avatar for fws

Hi all,

My problem is I can't access web pages by IE6.0.29 when server uses the DES-CBC-SHA or other(DES or DES3) cipher suits.
But the firefox work well.:eek: (good fox).

The server is worked with stunnel-4.15 and openssl-0.9.8b.
I just enabled the DES-CBC-SHA cipher(I had already tried other cipher suits too). I found only RC4 cipher suits are ok. Is any wrong configuration with my server? or the IE?:?:
Best regards,
Person

I ran into a very similar problem. I think that the solution is to use the SSL_OP_ALL or SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS flags for OpenSSL. Look at the SSL_CTX_set_options(3) documentation:
http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html

Member Avatar for person

I ran into a very similar problem. I think that the solution is to use the SSL_OP_ALL or SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS flags for OpenSSL. Look at the SSL_CTX_set_options(3) documentation:
http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html

You are right!!
I love you~:cheesy: SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
Regards,
Person

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.