Why is the handshake protocol sslv3 when the client hello is sslv2

StackOverflow https://stackoverflow.com/questions/13586476

Question

We've been having issues getting a successful SSL connection from a client app trying to connect using wininet on windows xp sp3 (ie v6). The client hello looks off to me, why would the hello state its version as SSL 2.0 and then state the handshake version as SSL 3.0? Is there something coded incorrectly from the app using wininet?

SSLv2 Record Layer: Client Hello
    [Version: SSL 2.0 (0x0002)]  <---------------------
    Length: 76
    Handshake Message Type: Client Hello (1)
    Version: SSL 3.0 (0x0300)    <---------------------
    Cipher Spec Length: 51
    Session ID Length: 0
    Challenge Length: 16
    Cipher Specs (17 specs)
    Challenge
Was it helpful?

Solution

SSLv3 and TLSv1.x have a compatibility mode in case the client also supports v2 servers, as described in the TLS specification (Backward Compatibility With SSL).

Some clients support this. For example Oracle/Sun Java has an SSLv2Hello pseudo-protocol, which uses SSLv2 Hello, but doesn't actually support SSLv2.

OTHER TIPS

I know this issue is solved but I will share some more info about the subject which may be useful for viewers

"The client sends a SSLv2 ClientHello so that a server who understands only SSLv2 can process that message, and continue with a SSLv2 handshake. But the SSLv2 ClientHello also says "by the way, I know SSLv3, so if you know SSLv3 too, let's do SSLv3 instead of SSLv2", which is what usually happens (servers who know only of SSLv2 are extremely rare nowadays)."

I took it from Thomas Pornin's comment, link https://security.stackexchange.com/questions/34827/why-clients-offer-handshaking-with-ssl-2-0-protocol

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top