openssl s_client -connect gmail.com:443 -ssl3 not working

Question

I have installed Ubuntu 16.04 LTS on my laptop for my testing. Connect to gmail.com using the following command.

openssl s_client -connect gmail.com:443 -ssl3

But I get the following error:

139903184385688:error:140A90C4:SSL routines:SSL_CTX_new:null ssl method passed:ssl_lib.c:1878

Question:

Am I missing any libraries to install? Or -ssl3 option is now not supported with openssl 1.0.2g-1ubuntu4.1?

Solution

SSLv3 has been permanently disabled in the version of openssl distributed with Ubuntu 16.04, so the -ssl3 option no longer has any effect.

From /usr/share/doc/openssl/changelog.Debian.gz:

openssl (1.0.2g-1ubuntu1) xenial; urgency=medium

  * Merge with Debian, remaining changes.
    - Disable SSLv3 without changing ABI:
      + debian/patches/no-sslv3.patch: Disable SSLv3 without using the
        no-ssl3-method option
      + debian/rules: don't use no-ssl3-method, don't bump soname
      + debian/patches/engines-path.patch: don't bump soname
      + debian/patches/version-script.patch: don't bump soname
      + debian/patches/soname.patch: removed
      + debian/lib*: don't bump soname

Comments

[Thomas Ward]

SSLv3 has a ton of security issues; you should be using TLS and not SSLv3

[Selivanov Pavel]

@ThomasWard : a lot of guys are still using it, and you need to work with this guys.

[Thomas Ward]

@SelivanovPavel Given that 16.04+ has SSLv3 intentionally disabled in OpenSSL, it's irrelevant. With SSLv3 disabled in OpenSSL, whether it's still 'used' or not is out the window, since newer systems can no longer support SSLv3. LibreSSL and others also have done the same thing, which makes SSLv3 effectively dead in terms of 'support'.

[Selivanov Pavel]

@ThomasWard I totaly get disabling SSLv3 for new installations, but disabling client software functions is IMHO irresponsible. Here, in messy real world, we are using php to connect to other guys API, and they are still using SSLv3. And we can not fix thier setup in any way, probably not even if we use firearms. And here comes new libssl and it's broken and php curl extension uses it and it's broken and our service is broken and everybody dies in horrible agony. Except openssl maintainers of course, who are happily living in Equestria with friendly ponies.