Disable SSLv3 In cURL?

Question

I'm having a problem connecting to a website that is hosted with CloudFlare using cURL. When I try to connect to the website with HTTPS (using curl -v https://www.xxxxxx.com), it says:

* About to connect() to www.xxxxxx.com port 443 (#0)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Error in TLS handshake, trying SSLv3...
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: www.xxxxxx.com
> Accept: */*
>
* Connection died, retrying a fresh connect
* Closing connection 0
* Issue another request to this URL: 'https://www.xxxxxx.com'
* About to connect() to www.xxxxxx.com port 443 (#1)
*   Trying 2400:cb00:2048:1::681c:116e...
* Connected to www.xxxxxx.com (2400:cb00:2048:1::681c:116e) port 443 (#1)
* TLS disabled due to previous handshake failure
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
* Cannot communicate securely with peer: no common encryption algorithm(s).
* Closing connection 1
curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

I contacted CloudFlare about this issue and they say its because cURL is trying to connect using SSLv3 and they disabled it because of the POODLE vulnerability. I'm able to connect with cURL v7.38.0 on FreeBSD 10 no problems, but not with cURL v7.29.0 on CentOS 6.5.

If it is because it's trying to connect to SSLv3, then how do I disable SSLv3 on cURL? Or is it something else?

Solution

It looks like this problem is caused by the version of cURL not supporting ECC 256 bit SSL certificates and the ECDSA signature algorithm (which is used by CloudFlare). You can test to see if your version of cURL supports this encryption by running:

curl -1IsS --ciphers ecdhe_ecdsa_aes_128_sha https://sslspdy.com

If you get the following, then your cURL is out of date:

curl: (59) Unknown cipher in list: ecdhe_ecdsa_aes_128_sha

Otherwise, if it connects and doesn't display an error then it is up to date.

Since CentOS seems to thoroughly screen updates before they are applied to their packages, it's hard to say when this will be fixed. The ONLY way to get around this is by updating cURL, passing -k or --insecure won't work.

Comments

[jordanm]

Try upgrading nss.

[Sreeraj]

An equally important thing to do is to enable curl to use TLS. Your curl does not seem capable to handle TLS protocol which is why it fell back to SSLv3 in the first place. Disabling SSLv3 will leave with a curl that won't be able to make any kind of SSL connections since your don't seem to have TLS capability. I will update this thread/comment if I am able to find something.

[Graham]

Note there are negotiation issues also. I.E. specifying the --ciphers as you do above works, but that's currently required

[ub3rst4r]

I'm running CentOS v7.1.1503 (with all updates up to July 15, 2015) and cURL works ONLY if --ciphers ecdhe_ecdsa_aes_128_sha is specified. Otherwise, it gives the error NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)