ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)

Question

I'm trying to connect to multiple hosts that have Self-signed certificates on https to grab html title and headers but i'm getting errors reference:StackTrace but when i do the same on other hosts with signed certificates it works perfectly i checked a few forums but couldn't find anything that could fix my problem.

openssl version

OpenSSL 1.1.1f  31 Mar 2020
built on: Mon Apr 20 11:53:50 2020 UTC
platform: debian-amd64
options:  bn(64,64) rc4(8x,int) des(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific

main.py

#!/usr/bin/env python3
#coding:utf-8

from termcolor import colored
from bs4 import BeautifulSoup
import argparse
import socket
import json
import ssl
import sys

parser = argparse.ArgumentParser()

parser.add_argument("-i", "--ip", help = "<inputIP>")
parser.add_argument("-p", "--port", help = "The port to which you want to receive a response from")
if len(sys.argv)==1:
    parser.print_help()
    sys.exit(1)

args = parser.parse_args()


IP = str(args.ip)
port = int(args.port)

context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.verify_mode = ssl.CERT_NONE
ssock = context.wrap_socket(socket.socket())
socket.setdefaulttimeout(0.5)
ssock.connect((IP, port))
hostname = socket.getfqdn(IP)
request = ("GET / HTTP/1.1\r\nHost: " + IP + "\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n").encode('utf-8')
ssock.sendall(request)
while True:
    response = ssock.recv(2048).decode('utf-8')
    if ( len(response) < 1 ):
        break
    (headers, body) = response.split("\r\n\r\n")
    soup = BeautifulSoup(body, 'html.parser')
    if hostname == IP:
        print(colored(IP, 'green'), colored(port, 'yellow'), colored(soup.title.string, 'blue'),  json.dumps(headers))
    else:
        print(colored(IP, 'green'), colored(port, 'yellow'), colored(hostname, 'magenta'), colored(soup.title.string, 'blue'), json.dumps(headers))
ssock.close()

StackTrace:

Traceback (most recent call last):
  File "./https.py", line 30, in <module>
    ssock.connect((IP, port))
  File "/usr/lib/python3.8/ssl.py", line 1342, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.8/ssl.py", line 1333, in _real_connect
    self.do_handshake()
  File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1108)
^[[DTraceback (most recent call last):
  File "./https.py", line 30, in <module>
    ssock.connect((IP, port))
  File "/usr/lib/python3.8/ssl.py", line 1342, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.8/ssl.py", line 1329, in _real_connect
    super().connect(addr)
TimeoutError: [Errno 110] Connection timed out
Traceback (most recent call last):
  File "./https.py", line 30, in <module>
    ssock.connect((IP, port))
  File "/usr/lib/python3.8/ssl.py", line 1342, in connect
    self._real_connect(addr, False)
  File "/usr/lib/python3.8/ssl.py", line 1333, in _real_connect
    self.do_handshake()
  File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)

Given that it works for other hosts it is likely the host in question does not support TLS on this specific IP and port, requires SNI, does not support the TLS version etc. More can only be said if the specific IP and port is known which causes the trouble. — Steffen Ullrich
– Steffen Ullrich, Commented Oct 6, 2020 at 17:40
tried to access those host in firefox and it works it just dosen't seem to work in python — user14389484
– user14389484, Commented Oct 6, 2020 at 17:47
Did you access the host in Firefox by IP address or by domain name? — Steffen Ullrich
– Steffen Ullrich, Commented Oct 6, 2020 at 17:55
Is the server accessible from public and can you provide the details so that one can have a further look? — Steffen Ullrich
– Steffen Ullrich, Commented Oct 6, 2020 at 18:16

Steffen Ullrich · Accepted Answer · 2020-10-06 18:44:27Z

1

From the list you provide only three IP addresses fail: 194.224.179.234, 124.65.100.3 fail with "unsupported protocol" while 114.6.128.61 fails with "dh key too small". The reason for these problems is a hardening done in recent versions of Debian (and Ubuntu) to increase the security requirements of TLS, for example by disabling TLS 1.0.

But the three IP addresses in question don't work with the increased security requirements, i.e. they require the disabled TLS 1.0 or have other less secure requirements. To downgrade the security settings for a specific TLS context set the security level to 1:

context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.set_ciphers('DEFAULT:@SECLEVEL=1')

With these settings it works for me with all IP addresses you've provided.

answered Oct 6, 2020 at 18:44

Steffen Ullrich

125k11 gold badges155 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related