Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • 2
    This error message seems to be pretty common when using ssldump (just google) and does not seem to indicate an actual problem with the TLS connection. Maybe you are also using an old version - see github.com/adulau/ssldump/issues/36 for a similar problem. Better do a packet capture and use wireshark to debug it before jumping to the wrong conclusions. Commented Jan 24, 2024 at 16:21
  • 1
    FYI: although version 3.3 (0x0303) was created for TLS1.2 and for quite a few years did definitively mean that, TLS1.3 kept the record level version at 3.3 and only made changes inside the records, so nowadays record version 3.3 can actually be either 1.2 or 1.3. Your dump however is 1.2: 1.3 has at least several hello extensions not in your dump, and does not have ServerKeyExchange which your dump has. And 327 is a reasonable length for ServerKX for ECDHE_RSA, whereas 32767 is absurd. I concur with Steffen: use wireshark, it decodes correctly. ... Commented Jan 25, 2024 at 0:47
  • 1
    ... Also, the keys (or keypairs) in DHE-now-called-FFDHE or ECDHE are ephemeral, but the parameters are not. For [FF]DHE the parameters must be supplied by the application where they are either hardcoded or configured (or both); for ECDHE the parameters, almost always called a 'curve' although technically that's not quite correct, are standardized and hardcoded in the TLS middleware such as OpenSSL or Schannel. Which reminds me, if you haven't already, look in the Windows event log on the client=Outlook machine for any relevant entries. Commented Jan 25, 2024 at 0:52
  • Thanks a lot to dave and Steffen for the explanations and clarifications regarding the version numbering and the DHE parameters, and +1. You are also right in that there actually is no problem with the key agreement; please see my own answer. I'll surely use Wireshark in the future and avoid ssldump. Commented Jan 25, 2024 at 11:20