SSL wrong version number when sending request to server using TLSv1.2

[GTP95]

Greetings,

I'm trying to send a POST request to an HTTPS server that uses TLSv1.2. Those are the functions involved in building and sending the request:

async fn oauth_request(server_address: &str, user_id: &str, spoof_check_secret: &str, uid_field_name: &str, client: &HttpsClient) {

    let request_result = client
        .send_auth_request(&String::from(user_id), &spoof_check_secret)
        .await;
    match request_result {
        Ok(response) => println!("Response: {:?}", response),
        Err(error) => {
            println!("Error: {:?}", error);
            println!("user_id: {:?}", user_id);
            println!("uid_field_name: {:?}", uid_field_name);
            println!("spoof_check_secret: {:?}", spoof_check_secret);

        },
    }
}

pub async fn send_auth_request(&self, uid: &str, spoof_check_secret: &str) -> Result<reqwest::Response, reqwest::Error> {
        let request = self.client
            .post(&self.url)
            .header("Shib-Spoof-Check", spoof_check_secret)
            .header(self.uid_field_name.clone(), uid)
            .body("")
            .send()
            .await?;
        Ok(request)
    }

I tried building my HTTPS client with different options, here is what I tried and the relative error:

pub fn new(url: String, uid_field_name: String, spoof_check_secret: String, root_ca_certificate_path: String)-> HttpsClient {
        let buf= read(root_ca_certificate_path).expect("Error reading root CA certificate");
        let cert = reqwest::Certificate::from_pem(&buf).expect("Error parsing root CA certificate");
        let client_builder=reqwest::Client::builder()
            .add_root_certificate(cert)
            .use_native_tls()
            .connection_verbose(true); //print verbose connection info for debugging
        let client= client_builder.build().expect("Error building HTTPS client");

        HttpsClient {
            client: client,
            url: url,
            uid_field_name: uid_field_name,
            spoof_check_secret: spoof_check_secret
        }
    }

reqwest::Error { kind: Request, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: None, fragment: None }, source: hyper::Error(Connect, Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 167772427, library: "SSL routines", function: "ssl3_get_record", reason: "wrong version number", file: "ssl/record/ssl3_record.c", line: 354 }]))) }, X509VerifyResult { code: 0, error: "ok" })) }

(I'm on Arch Linux, so native tls should use OpenSSL)

pub fn new(url: String, uid_field_name: String, spoof_check_secret: String, root_ca_certificate_path: String)-> HttpsClient {
        let buf= read(root_ca_certificate_path).expect("Error reading root CA certificate");
        let cert = reqwest::Certificate::from_pem(&buf).expect("Error parsing root CA certificate");
        let client_builder=reqwest::Client::builder()
            .add_root_certificate(cert)
            .use_native_tls()
            .min_tls_version(reqwest::tls::Version::TLS_1_2)
            .connection_verbose(true); //print verbose connection info for debugging
        let client= client_builder.build().expect("Error building HTTPS client");

reqwest::Error { kind: Request, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: None, fragment: None }, source: hyper::Error(Connect, Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 167772427, library: "SSL routines", function: "ssl3_get_record", reason: "wrong version number", file: "ssl/record/ssl3_record.c", line: 354 }]))) }, X509VerifyResult { code: 0, error: "ok" })) }

pub fn new(url: String, uid_field_name: String, spoof_check_secret: String, root_ca_certificate_path: String)-> HttpsClient {
        let buf= read(root_ca_certificate_path).expect("Error reading root CA certificate");
        let cert = reqwest::Certificate::from_pem(&buf).expect("Error parsing root CA certificate");
        let client_builder=reqwest::Client::builder()
            .add_root_certificate(cert)
            .connection_verbose(true); //print verbose connection info for debugging
        let client= client_builder.build().expect("Error building HTTPS client");

        HttpsClient {
            client: client,
            url: url,
            uid_field_name: uid_field_name,
            spoof_check_secret: spoof_check_secret
        }
    }

reqwest::Error { kind: Request, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: None, fragment: None }, source: hyper::Error(Connect, Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 167772427, library: "SSL routines", function: "ssl3_get_record", reason: "wrong version number", file: "ssl/record/ssl3_record.c", line: 354 }]))) }, X509VerifyResult { code: 0, error: "ok" })) }

pub fn new(url: String, uid_field_name: String, spoof_check_secret: String, root_ca_certificate_path: String)-> HttpsClient {
        let buf= read(root_ca_certificate_path).expect("Error reading root CA certificate");
        let cert = reqwest::Certificate::from_pem(&buf).expect("Error parsing root CA certificate");
        let client_builder=reqwest::Client::builder()
            .add_root_certificate(cert)
            .min_tls_version(reqwest::tls::Version::TLS_1_2)
            .connection_verbose(true); //print verbose connection info for debugging
        let client= client_builder.build().expect("Error building HTTPS client");

        HttpsClient {
            client: client,
            url: url,
            uid_field_name: uid_field_name,
            spoof_check_secret: spoof_check_secret
        }
    }

reqwest::Error { kind: Request, url: Url { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/", query: None, fragment: None }, source: hyper::Error(Connect, Ssl(Error { code: ErrorCode(1), cause: Some(Ssl(ErrorStack([Error { code: 167772427, library: "SSL routines", function: "ssl3_get_record", reason: "wrong version number", file: "ssl/record/ssl3_record.c", line: 354 }]))) }, X509VerifyResult { code: 0, error: "ok" })) }

Is this an issue with the initial TLS negotiation?
Thank you for your help,

GTP95

[seanmonstar]

It sounds like an issue between your OpenSSL install and what the server is talking. I'd try searching about OpenSSL error code 167772427, and the reason "wrong version number". You could take a look at how new/old your local openssl package is, and whether it supports TLS 1.2. You could also try figuring out what version of TLS the server is actually using.

[GTP95]

According to the devs, the server uses TLS1.2. But I just tried with curl and I can't reach it with that either, so probably the problem is somewhere else:

$ curl -v --tlsv1.2 --tls-max 1.2 --cacert /home/giacomo/VirtualBox\ VMs/Cartella\ di\ passaggio/rootCA.cert https://localhost:8080 -H "uid: participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70" -H "Shib-Spoof-Check: be67c8dd6a141ded148861ac11aef64d68640876601a40dca01816004e4c5161"
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
*  CAfile: /home/giacomo/VirtualBox VMs/Cartella di passaggio/rootCA.cert
*  CApath: none
* OpenSSL/3.1.1: error:0A00010B:SSL routines::wrong version number
* Closing connection 0
curl: (35) OpenSSL/3.1.1: error:0A00010B:SSL routines::wrong version number

I'll ask them how do they test the connection.