Ubuntu can't establish SSL connections to Facebook.com | Hacker News Reader

Ubuntu can't establish SSL connections to Facebook.com

stackoverflow.com

13 pointszackmorris9 comments

Correction: One yahoo (who happens to be using Ubuntu) can't establish an SSL connection to Facebook.com when he manually uses a setting in OpenSSH he doesn't quite understand.

I can sympathize with how my question must sound ridiculous. But I have tried many combinations of parameters to OpenSSL and curl with no luck. It's looking at this point that the problem is due to an MTU below 1500:

http://askubuntu.com/questions/189752/cant-connect-to-certai...

But if that's the case, that's a serious problem with their OpenSSL implementation, because there is no way to control how packets are split once they are on the internet. All SSL should require is a single socket connection that can send and receive bytes, regardless of underlying protocol.

My frustration with this is that we shouldn't be seeing these types of issues this late in game with something as fundamental as SSL. This bug never should have made it into a stable release, and if it did, it should have been fixed immediately.

Because -cipher SRP-AES-256-CBC-SHA, that's why.

I should have been clearer that I was just passing a cipher to get any response at all. Without the cipher, it hangs after the client hello send. I've updated my question to reflect it.

Works for me: http://pastebin.com/MXk7NPC5

Hey thanks for posting a known-good result I can follow. I've apt-get updated/upgraded everything and run update-ca-certificates but still no luck. The MTU on our network is 1496 so that almost certainly must be the issue. I'll let everyone know if it is.

Speak of the PMTU ... http://www.daemonology.net/blog/2012-11-28-broken-EC2-firewa... :-)

Another interesting thing is that your connection is negotiating the use of TLS 1.1. If you have some type of man-in-the-middle box or stateful firewall, it may be getting upset by that.

A full packet capture would be useful here.

I have submitted a partial solution. Manually setting the MTU on my Ubuntu box to 1496 allows me to receive a response:

http://stackoverflow.com/questions/13596019/openssl-1-0-1-ha...

Yes it can.

Reply on news.ycombinator.com