Openssl is unable to establish SSL connection, when I try to access a local site through third party tools...
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
I want to monitor the index of a site periodically on our local network out of browsers. I tried to download it by wget in Windows10:
> wget --no-check-certificate --no-hsts --content-on-error --ignore-length --unlink --server-response --show-progress --verbose https://172.*.*.*:*/app
But it couldn't fetch the page. Here is the result:
--2019-02-02 16:56:01-- https://172.*.*.*:*/app
Connecting to 172.*.*.*:*... connected.
OpenSSL: error:2406F079:random number generator:RAND_load_file:Cannot open file
Unable to establish SSL connection.
I also tried with other tools like urlwatch and curl. None of them were able to get access to that page! Is there any idea? Here is the error given by urlwatch:
HTTPSConnectionPool(host='172.*.*.*', port=*):
Max retries exceeded with url: /app
(Caused by SSLError(SSLError(1,
'[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))
windows-10 wget openssl monitoring
edited Mar 28 at 23:00
Señor CMasMas
2486
asked Feb 5 at 8:51
minimini
917
add a comment |
I want to monitor the index of a site periodically on our local network out of browsers. I tried to download it by wget in Windows10:
> wget --no-check-certificate --no-hsts --content-on-error --ignore-length --unlink --server-response --show-progress --verbose https://172.*.*.*:*/app
But it couldn't fetch the page. Here is the result:
--2019-02-02 16:56:01-- https://172.*.*.*:*/app
Connecting to 172.*.*.*:*... connected.
OpenSSL: error:2406F079:random number generator:RAND_load_file:Cannot open file
Unable to establish SSL connection.
I also tried with other tools like urlwatch and curl. None of them were able to get access to that page! Is there any idea? Here is the error given by urlwatch:
HTTPSConnectionPool(host='172.*.*.*', port=*):
Max retries exceeded with url: /app
(Caused by SSLError(SSLError(1,
'[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))
windows-10 wget openssl monitoring
edited Mar 28 at 23:00
Señor CMasMas
2486
asked Feb 5 at 8:51
minimini
917
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you useopenssland its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Tryopenssl s_client -connect 172.*.*.*:<port>
– ssnobody
Mar 22 at 21:39
Check the fileopenssl.cnffor aRANDFILE=...configuration line and remove if found. Or are you using PowerShell wherewgetis an alias for Invoke-WebRequest? If you aren't, then you should consider using it.
– harrymc
Mar 23 at 8:19
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with tryings_clientif possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding-servername $host-- mini: browser can access this server by address?
– dave_thompson_085
Mar 24 at 13:03
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25
add a comment |
I want to monitor the index of a site periodically on our local network out of browsers. I tried to download it by wget in Windows10:
> wget --no-check-certificate --no-hsts --content-on-error --ignore-length --unlink --server-response --show-progress --verbose https://172.*.*.*:*/app
But it couldn't fetch the page. Here is the result:
--2019-02-02 16:56:01-- https://172.*.*.*:*/app
Connecting to 172.*.*.*:*... connected.
OpenSSL: error:2406F079:random number generator:RAND_load_file:Cannot open file
Unable to establish SSL connection.
I also tried with other tools like urlwatch and curl. None of them were able to get access to that page! Is there any idea? Here is the error given by urlwatch:
HTTPSConnectionPool(host='172.*.*.*', port=*):
Max retries exceeded with url: /app
(Caused by SSLError(SSLError(1,
'[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))
windows-10 wget openssl monitoring
edited Mar 28 at 23:00
Señor CMasMas
2486
asked Feb 5 at 8:51
minimini
917
I want to monitor the index of a site periodically on our local network out of browsers. I tried to download it by wget in Windows10:
> wget --no-check-certificate --no-hsts --content-on-error --ignore-length --unlink --server-response --show-progress --verbose https://172.*.*.*:*/app
But it couldn't fetch the page. Here is the result:
--2019-02-02 16:56:01-- https://172.*.*.*:*/app
Connecting to 172.*.*.*:*... connected.
OpenSSL: error:2406F079:random number generator:RAND_load_file:Cannot open file
Unable to establish SSL connection.
I also tried with other tools like urlwatch and curl. None of them were able to get access to that page! Is there any idea? Here is the error given by urlwatch:
HTTPSConnectionPool(host='172.*.*.*', port=*):
Max retries exceeded with url: /app
(Caused by SSLError(SSLError(1,
'[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1056)')))
windows-10 wget openssl monitoring
windows-10 wget openssl monitoring
edited Mar 28 at 23:00
Señor CMasMas
2486
asked Feb 5 at 8:51
minimini
917
edited Mar 28 at 23:00
Señor CMasMas
2486
asked Feb 5 at 8:51
minimini
917
edited Mar 28 at 23:00
Señor CMasMas
2486
edited Mar 28 at 23:00
Señor CMasMas
2486
edited Mar 28 at 23:00
Señor CMasMas
2486
2486
asked Feb 5 at 8:51
minimini
917
asked Feb 5 at 8:51
minimini
917
asked Feb 5 at 8:51
minimini
917
917
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you useopenssland its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Tryopenssl s_client -connect 172.*.*.*:<port>
– ssnobody
Mar 22 at 21:39
Check the fileopenssl.cnffor aRANDFILE=...configuration line and remove if found. Or are you using PowerShell wherewgetis an alias for Invoke-WebRequest? If you aren't, then you should consider using it.
– harrymc
Mar 23 at 8:19
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with tryings_clientif possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding-servername $host-- mini: browser can access this server by address?
– dave_thompson_085
Mar 24 at 13:03
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25
add a comment |
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you useopenssland its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Tryopenssl s_client -connect 172.*.*.*:<port>
– ssnobody
Mar 22 at 21:39
Check the fileopenssl.cnffor aRANDFILE=...configuration line and remove if found. Or are you using PowerShell wherewgetis an alias for Invoke-WebRequest? If you aren't, then you should consider using it.
– harrymc
Mar 23 at 8:19
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with tryings_clientif possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding-servername $host-- mini: browser can access this server by address?
– dave_thompson_085
Mar 24 at 13:03
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you use
openssl and its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Try openssl s_client -connect 172.*.*.*:<port>– ssnobody
Mar 22 at 21:39
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you use
openssl and its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Try openssl s_client -connect 172.*.*.*:<port>– ssnobody
Mar 22 at 21:39
Check the file
openssl.cnf for a RANDFILE=... configuration line and remove if found. Or are you using PowerShell where wget is an alias for Invoke-WebRequest? If you aren't, then you should consider using it.– harrymc
Mar 23 at 8:19
Check the file
openssl.cnf for a RANDFILE=... configuration line and remove if found. Or are you using PowerShell where wget is an alias for Invoke-WebRequest? If you aren't, then you should consider using it.– harrymc
Mar 23 at 8:19
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with trying
s_client if possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding -servername $host -- mini: browser can access this server by address?– dave_thompson_085
Mar 24 at 13:03
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with trying
s_client if possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding -servername $host -- mini: browser can access this server by address?– dave_thompson_085
Mar 24 at 13:03
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25
add a comment |
2 Answers
2
active
oldest
votes
Why You don't try curl instead ?
For your reference go to this site
It is very common to replace wget with curl under some scenarios. Probably this case is a good one to go with curl instead.
You can check this short example with Windows 10
If the problem persist, definitely You will require to update ssl to the latest version or use Open SSL library for Windows 10. To avoid risk installing third party installer, get further details from here.
The Git for Windows installation already contains the openssl.exe You need, You can get it from here. I have used this solution in the past and worked well.
Check this for your reference as well.
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
add a comment |
There is no reason in Windows to use a third-party tool to download a file,
when such tools already exist natively,
especially if that tool is badly adapted to Windows.
For downloading a file, you may use PowerShell with the methods of
Invoke-WebRequest
or
Client.DownloadFile,
and here are some examples:
Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/Handle.zip' -OutFile C:handle.zip
download.file("https://download.sysinternals.com/files/Handle.zip",destfile="C:handle.zip")
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402161%2fopenssl-is-unable-to-establish-ssl-connection-when-i-try-to-access-a-local-site%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Why You don't try curl instead ?
For your reference go to this site
It is very common to replace wget with curl under some scenarios. Probably this case is a good one to go with curl instead.
You can check this short example with Windows 10
If the problem persist, definitely You will require to update ssl to the latest version or use Open SSL library for Windows 10. To avoid risk installing third party installer, get further details from here.
The Git for Windows installation already contains the openssl.exe You need, You can get it from here. I have used this solution in the past and worked well.
Check this for your reference as well.
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
add a comment |
Why You don't try curl instead ?
For your reference go to this site
It is very common to replace wget with curl under some scenarios. Probably this case is a good one to go with curl instead.
You can check this short example with Windows 10
If the problem persist, definitely You will require to update ssl to the latest version or use Open SSL library for Windows 10. To avoid risk installing third party installer, get further details from here.
The Git for Windows installation already contains the openssl.exe You need, You can get it from here. I have used this solution in the past and worked well.
Check this for your reference as well.
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
add a comment |
Why You don't try curl instead ?
For your reference go to this site
It is very common to replace wget with curl under some scenarios. Probably this case is a good one to go with curl instead.
You can check this short example with Windows 10
If the problem persist, definitely You will require to update ssl to the latest version or use Open SSL library for Windows 10. To avoid risk installing third party installer, get further details from here.
The Git for Windows installation already contains the openssl.exe You need, You can get it from here. I have used this solution in the past and worked well.
Check this for your reference as well.
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
Why You don't try curl instead ?
For your reference go to this site
It is very common to replace wget with curl under some scenarios. Probably this case is a good one to go with curl instead.
You can check this short example with Windows 10
If the problem persist, definitely You will require to update ssl to the latest version or use Open SSL library for Windows 10. To avoid risk installing third party installer, get further details from here.
The Git for Windows installation already contains the openssl.exe You need, You can get it from here. I have used this solution in the past and worked well.
Check this for your reference as well.
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
edited Mar 27 at 23:19
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
answered Mar 27 at 23:14
MarioChavaMarioChava
27126
27126
add a comment |
add a comment |
There is no reason in Windows to use a third-party tool to download a file,
when such tools already exist natively,
especially if that tool is badly adapted to Windows.
For downloading a file, you may use PowerShell with the methods of
Invoke-WebRequest
or
Client.DownloadFile,
and here are some examples:
Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/Handle.zip' -OutFile C:handle.zip
download.file("https://download.sysinternals.com/files/Handle.zip",destfile="C:handle.zip")
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
add a comment |
There is no reason in Windows to use a third-party tool to download a file,
when such tools already exist natively,
especially if that tool is badly adapted to Windows.
For downloading a file, you may use PowerShell with the methods of
Invoke-WebRequest
or
Client.DownloadFile,
and here are some examples:
Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/Handle.zip' -OutFile C:handle.zip
download.file("https://download.sysinternals.com/files/Handle.zip",destfile="C:handle.zip")
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
add a comment |
There is no reason in Windows to use a third-party tool to download a file,
when such tools already exist natively,
especially if that tool is badly adapted to Windows.
For downloading a file, you may use PowerShell with the methods of
Invoke-WebRequest
or
Client.DownloadFile,
and here are some examples:
Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/Handle.zip' -OutFile C:handle.zip
download.file("https://download.sysinternals.com/files/Handle.zip",destfile="C:handle.zip")
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
There is no reason in Windows to use a third-party tool to download a file,
when such tools already exist natively,
especially if that tool is badly adapted to Windows.
For downloading a file, you may use PowerShell with the methods of
Invoke-WebRequest
or
Client.DownloadFile,
and here are some examples:
Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/Handle.zip' -OutFile C:handle.zip
download.file("https://download.sysinternals.com/files/Handle.zip",destfile="C:handle.zip")
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
answered Mar 28 at 7:26
harrymcharrymc
264k14273582
264k14273582
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
add a comment |
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
Here is how you might call it from outside of powershell (so you can use it just like wget) --> "powershell.exe -Command (new-object System.Net.WebClient).DownloadFile('download.sysinternals.com/files/Handle.zip','c:my_out_dirHandle.zip')" <--
– Señor CMasMas
Mar 28 at 21:41
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1402161%2fopenssl-is-unable-to-establish-ssl-connection-when-i-try-to-access-a-local-site%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
It looks like your clients are trying to negotiate SSL version 3. This is an old protocol, and most webservers have disabled support for it in preference to TLS 1.0/1.1/1.2/1.3 Can you use
openssland its s_client connect functionality to check that you can successfully negotiate a SSL connection to that system? Tryopenssl s_client -connect 172.*.*.*:<port>– ssnobody
Mar 22 at 21:39
Check the file
openssl.cnffor aRANDFILE=...configuration line and remove if found. Or are you using PowerShell wherewgetis an alias for Invoke-WebRequest? If you aren't, then you should consider using it.– harrymc
Mar 23 at 8:19
@ssnobody: 'sslv3 alert handshake failure' only means the alert code (40) was first defined by sslv3; it does not mean sslv3 protocol was tried (or used). Although we can't be sure 'urlwatch' is using the same OpenSSL 'wget' is, the 'wget' is definitely using 1.1.1, and post-POODLE versions of OpenSSL (1.1.0 and 1.1.1) don't even compile sslv3 capability by default. That said, I concur with trying
s_clientif possible, and although a host accessed by address probably isn't using SNI, if < 1.1.1 consider adding-servername $host-- mini: browser can access this server by address?– dave_thompson_085
Mar 24 at 13:03
@harrymc: some commandline utilities use RANDFILE from configfile, but libssl does not. The error message shown from 'wget' is definitely OpenSSL (used by real wget) not MS schannel (used indirectly by powershell). Although it might be a wget version not updated for OpenSSL 1.1.1, which returns error from RAND_load_file in (quite a few) cases where prior versions ignored the error and just returned 'no data', which is usually ignorable since RAND still autoseeds.
– dave_thompson_085
Mar 24 at 13:07
There is no reason in Windows 10 to use a third-party tool to download a file when this is built into PowerShell. You may use Invoke-WebRequest or Client.DownloadFile. Let me know if you wish me to post an answer.
– harrymc
Mar 24 at 20:25