Bug #11739: OpenSSL::SSL::SSLServer doesn't negotiate ECDHE-* ciphersuites

• Status: Rejected
• Assignee: -
• Target version: -
• Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN

[weeks (Branodn Weeks)]

I'm trying to configure an instance of OpenSSL::SSL::SSLServer that supports Elliptic curve Diffie–Hellman. No matter what combination of Ruby and OpenSSL versions I try the negotiation with the client fails.

Proof of concept:
https://gist.github.com/brandonweeks/e26414cc1e9eea9453a8

Then run:

openssl s_client -connect localhost:8443

Also attaching a pcap file of the failed handshake.

[ko1 (Koichi Sasada)]

• Assignee set to 7150

[rhenium (Kazuki Yamaguchi)]

• Related to Bug #10497: OpenSSL Servers Do Not Support EC Certificates added

[rhenium (Kazuki Yamaguchi)]

• Related to Feature #11356: Add ECDH support to OpenSSL wrapper added

[rhenium (Kazuki Yamaguchi)]

• Status changed from Open to Closed

ext/openssl didn't support ephemeral ECDH in server mode up until Ruby 2.3 (Feature #11356).

[usa (Usaku NAKAMURA)]

• Status changed from Closed to Rejected