Curl SSL connection problem

giacombum · 2017-06-22 13:47:43

I've a problem with curl and ssl connection (maybe I'm behind a firewall) that make impossible to use yaourt or git. If I try to download a simple .git project with curl, I obtain the error:

[giacomo@sputnik]: ~>$ curl https://github.com/Fortran-FOSS-Programmers/FOODIE.git
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443

while if I use aria2 to download the project, everything is ok:

aria2c https://github.com/Fortran-FOSS-Programmers/FOODIE.git

06/22 15:45:00 [NOTICE] Downloading 1 item(s)

06/22 15:45:01 [NOTICE] CUID#7 - Redirecting to https://github.com/Fortran-FOSS-Programmers/FOODIE
[#7e2946 0B/0B CN:1 DL:40KiB]
06/22 15:45:02 [NOTICE] Download complete: /home/giacomo/FOODIE

Download Results:
gid   |stat|avg speed  |path/URI
======+====+===========+=======================================================
7e2946|OK  |    94KiB/s|/home/giacomo/FOODIE

Status Legend:
(OK):download completed.

Do am I behind a firewall? Or is it a curl problem? How can I solve?

giacombum · 2017-06-22 16:39:48

Is possible for example to use aria2 instead curl for all yaourt and pacman operations? And for git?

seth · 2017-06-22 19:28:15

Output of

curl -kv https://github.com/Fortran-FOSS-Programmers/FOODIE.git

?

giacombum · 2017-06-23 04:39:54

seth wrote:

Output of

curl -kv https://github.com/Fortran-FOSS-Programmers/FOODIE.git

?

I'm out for work, I'll try it on Monday

giacombum · 2017-06-26 07:18:04

seth wrote:

Output of

curl -kv https://github.com/Fortran-FOSS-Programmers/FOODIE.git

?

This is the result of the command:

[giacomo@sputnik]: ~>$ curl -kv https://github.com/Fortran-FOSS-Programmers/FOODIE.git
*   Trying 192.30.253.112...
* TCP_NODELAY set
* Connected to github.com (192.30.253.112) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443
* stopped the pause stream!
* Closing connection 0

It seems that the certificates are ok, so what's wrong?

x33a · 2017-06-26 11:51:18

Looks like the SSL handshake is failing.

Interestingly, aria2 uses GnuTLS instead of OpenSSL, so the problem is likely with OpenSSL, since both git and curl depend on that.

Does the SSL issue only happen with Github?

giacombum · 2017-06-26 11:58:14

x33a wrote:

Does the SSL issue only happen with Github?

What other site can I try? Also on bitbucket the problem appears...

x33a · 2017-06-26 11:59:43

Then it's not site specific. Do these websites work fine in the browsers (Firefox, Chromium, etc.).

Most importantly, is your system fully updated?

x33a · 2017-06-26 12:10:07

Can you post the output of the following:

openssl s_client -connect github.com:443
gnutls-cli github.com

giacombum · 2017-06-26 12:11:39

x33a wrote:

Then it's not site specific. Do these websites work fine in the browsers (Firefox, Chromium, etc.).

Yes, I can go into the github.com site (also if I cannot login because of @ character is not recognized by chromium).

x33a wrote:

Most importantly, is your system fully updated?

Yes, of course. I've installed it ten days ago and every day I run

sudo pacman -Syu

seth · 2017-06-26 12:37:21

Check

pacman -Qs openssl

notably whether there's some "compat" package ...

giacombum · 2017-06-26 12:44:04

seth wrote:

Check
pacman -Qs openssl
notably whether there's some "compat" package ...

[giacomo@sputnik]: ~>$ pacman -Qs openssl
local/openssl 1.1.0.f-1
    The Open Source toolkit for Secure Sockets Layer and Transport Layer Security
local/openssl-1.0 1.0.2.l-1
    The Open Source toolkit for Secure Sockets Layer and Transport Layer Security

seth · 2017-06-26 12:57:03

Meh.

ldd `which curl` | grep -E '(ssl|crypto)'

realpath the reolved libs and check the ownership of the file, eg.

realpath /usr/lib/libssl.so.1.1 # assumes the resolved lib is /usr/lib/libssl.so.1.1 ...
pacman -Qo /usr/lib/libssl.so.1.1 # ... and that is not a symlink

giacombum · 2017-06-26 13:08:48

[giacomo@sputnik]: ~>$ ldd `which curl` | grep -E '(ssl|crypto)'
        libssl.so.1.1 => /usr/lib/libssl.so.1.1 (0x00007fa27d45b000)
        libcrypto.so.1.1 => /usr/lib/libcrypto.so.1.1 (0x00007fa27cfdb000)
        libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00007fa27c86b000)
[giacomo@sputnik]: ~>$ realpath /usr/lib/libssl.so.1.1
/usr/lib/libssl.so.1.1
[giacomo@sputnik]: ~>$ pacman -Qo /usr/lib/libssl.so.1.1
/usr/lib/libssl.so.1.1 is owned by openssl 1.1.0.f-1
[giacomo@sputnik]: ~>$ realpath /usr/lib/libcrypto.so.1.1
/usr/lib/libcrypto.so.1.1
[giacomo@sputnik]: ~>$ pacman -Qo /usr/lib/libcrypto.so.1.1
/usr/lib/libcrypto.so.1.1 is owned by openssl 1.1.0.f-1
[giacomo@sputnik]: ~>$ realpath /usr/lib/libk5crypto.so.3
/usr/lib/libk5crypto.so.3.1
[giacomo@sputnik]: ~>$ pacman -Qo /usr/lib/libk5crypto.so.3
/usr/lib/libk5crypto.so.3 is owned by krb5 1.15.1-1

seth · 2017-06-26 13:36:50

Dead end, try https://bbs.archlinux.org/viewtopic.php … 8#p1720708 and also ensure curl is from the stock repo and not some dangeling AUR package.
Also see "pacman -Qs curl" on whether you eg. have libcurl-compat installed.
Then I'm out of ideas (my first guess was you're trying to use some dated TLS protocol being refused by the other end - but that's not the case)

giacombum · 2017-06-26 13:46:07

x33a wrote:

Can you post the output of the following:
openssl s_client -connect github.com:443
gnutls-cli github.com

[giacomo@sputnik]: ~>$ openssl s_client -connect github.com:443
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Extended Validation Server CA
verify return:1
depth=0 businessCategory = Private Organization, jurisdictionC = US, jurisdictionST = Delaware, serialNumber = 515755
0, street = "88 Colin P Kelly, Jr Street", postalCode = 94107, C = US, ST = California, L = San Francisco, O = "GitHu
b, Inc.", CN = github.com
verify return:1
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=5157550/street=88 C
olin P Kelly, Jr Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHeTCCBmGgAwIBAgIQC/20CQrXteZAwwsWyVKaJzANBgkqhkiG9w0BAQsFADB1
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMTQwMgYDVQQDEytEaWdpQ2VydCBTSEEyIEV4dGVuZGVk
IFZhbGlkYXRpb24gU2VydmVyIENBMB4XDTE2MDMxMDAwMDAwMFoXDTE4MDUxNzEy
MDAwMFowgf0xHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYB
BAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQF
Ewc1MTU3NTUwMSQwIgYDVQQJExs4OCBDb2xpbiBQIEtlbGx5LCBKciBTdHJlZXQx
DjAMBgNVBBETBTk0MTA3MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEVMBMGA1UEChMMR2l0SHViLCBJbmMu
MRMwEQYDVQQDEwpnaXRodWIuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA54hc8pZclxgcupjiA/F/OZGRwm/ZlucoQGTNTKmBEgNsrn/mxhngWmPw
bAvUaLP//T79Jc+1WXMpxMiz9PK6yZRRFuIo0d2bx423NA6hOL2RTtbnfs+y0PFS
/YTpQSelTuq+Fuwts5v6aAweNyMcYD0HBybkkdosFoDccBNzJ92Ac8I5EVDUc3Or
/4jSyZwzxu9kdmBlBzeHMvsqdH8SX9mNahXtXxRpwZnBiUjw36PgN+s9GLWGrafd
02T0ux9Yzd5ezkMxukqEAQ7AKIIijvaWPAJbK/52XLhIy2vpGNylyni/DQD18bBP
T+ZG1uv0QQP9LuY/joO+FKDOTler4wIDAQABo4IDejCCA3YwHwYDVR0jBBgwFoAU
PdNQpdagre7zSmAKZdMh1Pj41g8wHQYDVR0OBBYEFIhcSGcZzKB2WS0RecO+oqyH
IidbMCUGA1UdEQQeMByCCmdpdGh1Yi5jb22CDnd3dy5naXRodWIuY29tMA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwdQYDVR0f
BG4wbDA0oDKgMIYuaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTItZXYtc2Vy
dmVyLWcxLmNybDA0oDKgMIYuaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL3NoYTIt
ZXYtc2VydmVyLWcxLmNybDBLBgNVHSAERDBCMDcGCWCGSAGG/WwCATAqMCgGCCsG
AQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAcGBWeBDAEBMIGI
BggrBgEFBQcBAQR8MHowJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0
LmNvbTBSBggrBgEFBQcwAoZGaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp
Z2lDZXJ0U0hBMkV4dGVuZGVkVmFsaWRhdGlvblNlcnZlckNBLmNydDAMBgNVHRMB
Af8EAjAAMIIBfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdgCkuQmQtBhYFIe7E6LM
Z3AKPDWYBPkb37jjd80OyA3cEAAAAVNhieoeAAAEAwBHMEUCIQCHHSEY/ROK2/sO
ljbKaNEcKWz6BxHJNPOtjSyuVnSn4QIgJ6RqvYbSX1vKLeX7vpnOfCAfS2Y8lB5R
NMwk6us2QiAAdgBo9pj4H2SCvjqM7rkoHUz8cVFdZ5PURNEKZ6y7T0/7xAAAAVNh
iennAAAEAwBHMEUCIQDZpd5S+3to8k7lcDeWBhiJASiYTk2rNAT26lVaM3xhWwIg
NUqrkIODZpRg+khhp8ag65B8mu0p4JUAmkRDbiYnRvYAdwBWFAaaL9fC7NP14b1E
sj7HRna5vJkRXMDvlJhV1onQ3QAAAVNhieqZAAAEAwBIMEYCIQDnm3WStlvE99GC
izSx+UGtGmQk2WTokoPgo1hfiv8zIAIhAPrYeXrBgseA9jUWWoB4IvmcZtshjXso
nT8MIG1u1zF8MA0GCSqGSIb3DQEBCwUAA4IBAQCLbNtkxuspqycq8h1EpbmAX0wM
5DoW7hM/FVdz4LJ3Kmftyk1yd8j/PSxRrAQN2Mr/frKeK8NE1cMji32mJbBqpWtK
/+wC+avPplBUbNpzP53cuTMF/QssxItPGNP5/OT9Aj1BxA/NofWZKh4ufV7cz3pY
RDS4BF+EEFQ4l5GY+yp4WJA/xSvYsTHWeWxRD1/nl62/Rd9FN2NkacRVozCxRVle
FrBHTFxqIP6kDnxiLElBrZngtY07ietaYZVLQN/ETyqLQftsf8TecwTklbjvm8NT
JqbaIVifYwqwNN+4lRxS3F5lNlA/il12IOgbRioLI62o8G0DaEUQgHNf8vSG
-----END CERTIFICATE-----
subject=/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=5157550/street=8
8 Colin P Kelly, Jr Street/postalCode=94107/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=github.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3641 bytes and written 302 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 1415E27FA1AC9CA6BB452AEBA5D0E81EAB399786C90ABEC75BEB5AFC361D7674
    Session-ID-ctx:
    Master-Key: 8BCCD78094C32520E2D9C75528220FB600659784951C1EA886E9090B8DD45D527DCD0EE678CDAC2F5CD3F1CF11E5E9F1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1498484713
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
closed
[giacomo@sputnik]: ~>$ gnutls-cli github.com
Processed 172 CA certificate(s).
Resolving 'github.com:443'...
Connecting to '192.30.253.113:443'...
- Certificate type: X.509
- Got a certificate list of 2 certificates.
- Certificate[0] info:
 - subject `CN=github.com,O=GitHub\, Inc.,L=San Francisco,ST=California,C=US,postalCode=94107,street=88 Colin P Kelly\, Jr Street,serialNumber=5157550,jurisdictionOfIncorporationStateOrProvinceName=Delaware,jurisdictionOfIncorporationCountryName=US,businessCategory=Private Organization', issuer `CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US', serial 0x0bfdb4090ad7b5e640c30b16c9529a27, RSA key 2048 bits, signed using RSA-SHA256, activated `2016-03-10 00:00:00 UTC', expires `2018-05-17 12:00:00 UTC', pin-sha256="pL1+qb9HTMRZJmuC/bB/ZI9d302BYrrqiVuRyW+DGrU="
        Public Key ID:
                sha1:d4ee9d2a6712b3614c272d158b04fcc8ca08a0b6
                sha256:a4bd7ea9bf474cc459266b82fdb07f648f5ddf4d8162baea895b91c96f831ab5
        Public Key PIN:
                pin-sha256:pL1+qb9HTMRZJmuC/bB/ZI9d302BYrrqiVuRyW+DGrU=
        Public key's random art:
                +--[ RSA 2048]----+
                |     .... ..     |
                |.     .. o..     |
                |o    . oooo      |
                |o.    o.=.o      |
                |...o . oS+.      |
                | E. o   *. . .   |
                |       . =. o    |
                |        + o.     |
                |         =.      |
                +-----------------+

- Certificate[1] info:
 - subject `CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US', issuer `CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US', serial 0x0c79a944b08c11952092615fe26b1d83, RSA key 2048 bits, signed using RSA-SHA256, activated `2013-10-22 12:00:00 UTC', expires `2028-10-22 12:00:00 UTC', pin-sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho="
- Status: The certificate is trusted.
- Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-128-GCM)
- Session ID: 9A:D8:36:EC:F8:2B:84:0A:F4:9A:87:72:8C:63:40:3B:B2:EC:02:22:DD:D6:76:EE:9D:84:30:D4:04:31:48:66
- Ephemeral EC Diffie-Hellman parameters
 - Using curve: SECP256R1
 - Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA512
- Cipher: AES-128-GCM
- MAC: AEAD
- Compression: NULL
- Options: extended master secret, safe renegotiation,
- Handshake was completed

- Simple Client Mode:

- Peer has closed the GnuTLS connection

giacombum · 2017-06-26 13:47:59

seth wrote:

Also see "pacman -Qs curl" on whether you eg. have libcurl-compat installed.

[giacomo@sputnik]: ~>$ pacman -Qs curl
local/curl 7.54.1-1
    An URL retrieval utility and library
[giacomo@sputnik]: ~>$ pacman -Ss libcurl
core/curl 7.54.1-1 [installed]
    An URL retrieval utility and library
extra/python-pycurl 7.43.0-3
    A Python 3.x interface to libcurl
extra/python2-pycurl 7.43.0-3
    A Python 2.x interface to libcurl
community/curlftpfs 0.9.2-6
    A filesystem for acessing FTP hosts based on FUSE and libcurl.
community/gnurl 7.54.0-1
    fork of libcurl, which is mostly for GNUnet
community/libcurl-compat 7.54.0-1
    An URL retrieval library (without versioned symbols)
community/libcurl-gnutls 7.54.0-1
    An URL retrieval library
multilib/lib32-libcurl-compat 7.54.0-1
    An URL retrieval library (without versioned symbols)
multilib/lib32-libcurl-gnutls 7.54.0-1
    An URL retrieval library

seth · 2017-06-26 14:02:55

type curl
cat  ~/.curlrc
printenv | grep -i proxy

Any of that being set to something stupid, please???? Prettyplease??
;-)

It's not openssl (the client works) but somehow the curl handshake fails.
It's probably no iptables/netfilter since gnutls works.

It should work™ :-(

giacombum · 2017-06-26 14:06:35

[giacomo@sputnik]: ~>$ type curl
curl is /usr/bin/curl
[giacomo@sputnik]: ~>$ cat  ~/.curlrc
cat: /home/giacomo/.curlrc: No such file or directory
[giacomo@sputnik]: ~>$ printenv | grep -i proxy
[giacomo@sputnik]: ~>$

Oh no, it seems everything ok :-( I wanna cry...

Arch without AUR isn't arch... and I desperately need github...

giacombum · 2017-06-26 14:49:25

Can I use aria (and not curl) for aur? And for github?

seth · 2017-06-26 14:57:24

The recommended way to use AUR is actuall git - what you can do elsewise mostly depends on the AUR helper that you should not be using :-P

As of github: you mean "git clone" etc. fails likewise??
Edit: yes, because git uses curl directly, not libcurl.

Last edited by seth (2017-06-26 15:00:55)

giacombum · 2017-06-26 15:01:16

seth wrote:

As of github: you mean "git clone" etc. fails likewise??

Yes, the commang git clone fails the same way:

[giacomo@sputnik]: ~>$ git clone https://github.com/Fortran-FOSS-Programmers/FOODIE.git
Cloning into 'FOODIE'...
fatal: unable to access 'https://github.com/Fortran-FOSS-Programmers/FOODIE.git/': OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443

seth · 2017-06-26 15:07:31

Do you have a github account?

git clone git@github.com:Fortran-FOSS-Programmers/FOODIE.git

giacombum · 2017-06-26 15:36:36

Yes, I've a github account... But why your command fails?

[giacomo@sputnik]: ~>$ git clone git@github.com:Fortran-FOSS-Programmers/FOODIE.git
Cloning into 'FOODIE'...
The authenticity of host 'github.com (192.30.253.112)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,192.30.253.112' (RSA) to the list of known hosts.
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

(my github: https://github.com/giacombum)

seth · 2017-06-26 15:47:57

Did you upload your public key to github? (The above requires a working git setup, notably name and email and github to have a public key assigned to your email address and matching your private key)

https://help.github.com/articles/connec … -with-ssh/

Arch Linux

#1 2017-06-22 13:47:43

Curl SSL connection problem

#2 2017-06-22 16:39:48

Re: Curl SSL connection problem

#3 2017-06-22 19:28:15

Re: Curl SSL connection problem

#4 2017-06-23 04:39:54

Re: Curl SSL connection problem

#5 2017-06-26 07:18:04

Re: Curl SSL connection problem

#6 2017-06-26 11:51:18

Re: Curl SSL connection problem

#7 2017-06-26 11:58:14

Re: Curl SSL connection problem

#8 2017-06-26 11:59:43

Re: Curl SSL connection problem

#9 2017-06-26 12:10:07

Re: Curl SSL connection problem

#10 2017-06-26 12:11:39

Re: Curl SSL connection problem

#11 2017-06-26 12:37:21

Re: Curl SSL connection problem

#12 2017-06-26 12:44:04

Re: Curl SSL connection problem

#13 2017-06-26 12:57:03

Re: Curl SSL connection problem

#14 2017-06-26 13:08:48

Re: Curl SSL connection problem

#15 2017-06-26 13:36:50

Re: Curl SSL connection problem

#16 2017-06-26 13:46:07

Re: Curl SSL connection problem

#17 2017-06-26 13:47:59

Re: Curl SSL connection problem

#18 2017-06-26 14:02:55

Re: Curl SSL connection problem

#19 2017-06-26 14:06:35

Re: Curl SSL connection problem

#20 2017-06-26 14:49:25

Re: Curl SSL connection problem

#21 2017-06-26 14:57:24

Re: Curl SSL connection problem

#22 2017-06-26 15:01:16

Re: Curl SSL connection problem

#23 2017-06-26 15:07:31

Re: Curl SSL connection problem

#24 2017-06-26 15:36:36

Re: Curl SSL connection problem

#25 2017-06-26 15:47:57

Re: Curl SSL connection problem

Board footer