0

I am getting an error instead of Server Hello from the server handshake, an alert protocol version with error 70. The description of SSL Layer shows description of 70. https://www.rfc-editor.org/rfc/rfc5246 The description describes version mismatch.

I cloned the server and uninstalled mysql8 and installed 5.7, and it works fine. It looks like the same exact client hello is offered to the servers but the mysql8 server rejects the version.

Here is a screenshot of the 2 pcaps: https://i.stack.imgur.com/CeYNw.jpg

I am unsure on how to log the processes (openssl or mysql) to see what the client (google apps jdbc) is offering for version, or how to dissect the pcap more than wireshark screenshot comparisons.

There are open bug tickets about this on google apps site, but none detailing the TLS handshake causing the failure.

Any ideas on how to troubleshoot this? Enable logging? Dissect the pcap more? I already enabled all the mysql logs I can find. No info in them.

I want to post about it with detailed "google you are offering this jdbc version but mysql8 requires this version" instead of just "it don't work"

Community
  • 1
  • 1
    I have no idea of the client and its setup. But I find it strange in that it only uses TLS 1.1 (i.e. not at least TLS 1.2) and only (a few) CBC ciphers. Because it has the TLS extension `supported_versions` which points to some newer TLS stack - which likely supports even TLS 1.3 but is deliberately configured to only use TLS 1.1 for some unknown reason. – Steffen Ullrich Feb 16 '21 at 21:32
  • Google apps scripts jdbc is the client. A support case response indicated microsoft's 8.4 JDBC Driver. I can't test with the client, nor tell it other settings like tls version because google restricts which options are passed. –  Feb 16 '21 at 21:36
  • You need to get the maintainers of the client to fix it. Indeed looks like a modern TLS client configured with https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CTX_set_max_proto_version with TLS1_1 – Z.T. Feb 16 '21 at 22:01

0 Answers0