> That is not a connection error, that looks like a configuration error to me > TLS: could not set cipher list TLSv1.2. > (In reply to Thomas Köller from comment #32) (In reply to Hubert Kario from comment #33) Ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) TLS: error: could not initialize moznss security context - error -12285:Unable to find the certificate or key necessary for authentication. TLS: loaded CA certificate file /etc/pki/tls/root_ca.pem. Ldap_sasl_interactive_bind: user selected: plain Ldap_result: Can't contact LDAP server (-1) TLS: can't connect: TLS error -12227:SSL peer was unable to negotiate an acceptable set of security parameters.Īdditional info: TLS error -12227:SSL peer was unable to negotiate an acceptable set of security parameters.

TLS: error: connect - force handshake failure: errno 0 - moznss error -12227 Omitting nss-sysinit and nss-tools package versions because they mirror nss package version. Showing client/server versions for nss package. I can provide one confirmation that the scratch build worked. If the issue is what Kai and I think it is, fixing it will require a lot of work so a fix likely won't be available quickly either, sorry. > This would take a couple of days, as I am rather busy right now. > certificate storage? That should workaround the issue. > Thomas, can you try configuring the server with nssdb for key and > (In reply to Hubert Kario from comment #10) (In reply to Thomas Köller from comment #12) Which version of OpenSSL? are you sure the server never processes a request from a client that uses new NSS before, for example, over loopback? > that being said, I can't reproduce it with selfserv, only with slapd > NSS library, that is because NSS advertises RSA-PSS signature method and NSS > TLS connections work fine from OpenSSL but fail if the client is also using > It looks like a problem with the newly introduced RSA-PSS signatures. > (In reply to Hubert Kario from comment #9) (In reply to Thomas Köller from comment #11)

Icecat 45.5.1