openssh unix dev - Jul 2017 - Administrivia: new list server

On July 8, 2017 16:59:52 PDT, Colin Watson wrote:
> On Wed, Jul 05, 2017 at 10:33:01PM +1000, Damien Miller wrote:
>>
>> I've migrated the list, bugzilla and anongit servers. With one  
>> exception
>> (below), you shouldn't see any difference. If you do then I've
>> messed up
>> and I'd appreciate your letting me know.
>
> Neither git://anongit.mindrot.org/openssh.git nor
> https://anongit.mindrot.org/openssh.git appears to work at the moment.
> The former times out, and the latter produces a TLS handshake failure.
FYI, you can use http://anongit.mindrot.org/openssh.git (plain http).

I'm able to connect with https. I get this message from curl about the  
connection when I enable verbose:

 > SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305

Or with an older curl/openssl combo:

 > SSL connection using ECDHE-RSA-AES256-GCM-SHA384

But if I try to connect with a client that only supports TLS 1.0 I get  
the error you describe above.

I suspect your client does not support TLS 1.2, but the server  
requires it (that seems to be a trend I've noticed recently).

--Kyle

On Tue, Jul 18, 2017 at 02:13:02PM -0700, Kyle J. McKay
wrote:
> On July 8, 2017 16:59:52 PDT, Colin Watson wrote:
> > Neither git://anongit.mindrot.org/openssh.git nor
> > https://anongit.mindrot.org/openssh.git appears to work at the moment.
> > The former times out, and the latter produces a TLS handshake failure.
> 
> FYI, you can use http://anongit.mindrot.org/openssh.git (plain http).
> 
> I'm able to connect with https. I get this message from curl about the
> connection when I enable verbose:
> 
> > SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305
> 
> Or with an older curl/openssl combo:
> 
> > SSL connection using ECDHE-RSA-AES256-GCM-SHA384
> 
> But if I try to connect with a client that only supports TLS 1.0 I get the
> error you describe above.
> 
> I suspect your client does not support TLS 1.2, but the server requires it
> (that seems to be a trend I've noticed recently).
No, I think it's just been fixed since I reported it.  I try not to run
archaic clients if I don't have to. :-)

-- 
Colin Watson                                       [cjwatson at debian.org]