2

When using the Indy TCP Server with the IO handler we get the following error.

routines:SSL23_GET_CLIENT_HELLO:unknown protocol

This error looks similar to the SSL Libary issue 10.3.3 however those fixes are in place for Delphi 11.

Updating Indy does not appear possible in 11 as you are unable to uninstall the features.

Does anyone have a fix or work around?

Reallyethical
  • 1,825
  • 2
  • 16
  • 26
  • Get Indy from the Indy repo – David Heffernan Jan 11 '22 at 17:59
  • @David 280 (Delphi 11) not listed on the Git Hub repo unless I am missing something quite basic – Reallyethical Jan 11 '22 at 18:22
  • @Reallyethical Project files for compiling Indy in Delphi 11 are not available yet in Indy's repo, no. Embarcadero uses their own projects when compiling Indy for bundling into the IDE. – Remy Lebeau Jan 11 '22 at 19:32
  • @Reallyethical "*... and was patched in 10.3.3 by Embarcadero*" - Are you referring to [this patch](https://blogs.embarcadero.com/rad-studio-10-3-3-indy-server-ssl-certificate-patch/)? That patch is included in the Indy version that shipped with Delphi 11, so your problem is likely related to something else. In any case, that patch had nothing to do with addressing "unknown protocol" errors, but with fixing a logic error in loading SSL certificates. More likely, you are probably just using the IOHandler incorrectly, such as activating SSL on a non-SSL port. Please provide a [mcve]. – Remy Lebeau Jan 11 '22 at 19:34
  • It's not hard to make a project file for the latest version of Delphi surely – David Heffernan Jan 11 '22 at 19:49
  • Thanks @Remy and David, I have reworked the question so it may have some value to others in the future. As you said Remy this was a miss configuration rather than anything to do with the former patch. – Reallyethical Jan 12 '22 at 11:25
  • @DavidHeffernan I don't have the latest version installed yet – Remy Lebeau Jan 12 '22 at 14:25

2 Answers2

3

As Remy Lebeau Stated above the issue was not to do with the indy component library itself but an older implementation.

in our case we had set the PassThrough in an earlier version of Delphi and Indy:

TIdSSLIOHandlerSocketBase(AContext.Connection.IOHandler).PassThrough := False;

This worked up to Delphi 10.3.3 without causing any problems, however, this code had to be removed in 11 for the Client and Server to function correctly.

Reallyethical
  • 1,825
  • 2
  • 16
  • 26
  • Setting `PassThrough=False` like that initiates an SSL/TLS handshake with the client. So, if the client does not perform the handshake, then the error you are seeing makes sense. But then, why was your code setting `PassThrough` like that to begin with? Has your server design changed to not need TLS anymore, or to initiate it at a different time (ala STARTTLS style) ? – Remy Lebeau Jan 12 '22 at 14:30
2

Delphi 10.3 has the TIdSSLIOHandlerSocketBase in IdSSL.pas which by default sets the fPassThrough to false on creation

Later version of the TIdSSLIOHandlerSocketBase in IdSSL.pas includes the InitComponent procedure, which sets the fPassThrough := True;

This appears to be a breaking change and has also broken our implementation.

The fix by Reallyethical solves the issue

Preben Thomsen
  • 31
  • 2