SocketTlsHandshake fails against server with self-signed certificate - page 2

[Alain Verleyen]

tandoori_mql #:

Hey,

yeah you're right with the first thing. That only proves that the certificate is acknowledged, not why. But does anyone know something about an internal certificate store of MT5? I mean how else should certificates be acknowledged than via MT5-internal mechanisms or via the certificate store of the OS?

Information is always useful, but in this case that will not help you anyway, as it's nothing under your control.

And thanks a great deal for the tip with the legacy nomenclature. That brings us further forward, although this means that we are kind of at the beginning of the analysis again, but at least we are not digging in the wrong direction any more.

There is no proof the problem is a certificate issue. The SSLV3_ALERT_ILLEGAL_PARAMETER seems to mean something else.

Do you have any idea of how to probe a client for his supported protocols? With Python I can not force single protocols any more (deprecated since 3.6) and therefore probing is uncomfortable here, since Python-wise the only thing I could imagine is to copy the ssl package and add logging to its handshake handling at the right places, since it does not seem to have internal logging by itself (https://stackoverflow.com/questions/26554106/python-3-how-to-log-ssl-handshake-errors-from-server-side).

ctx.maximum_version = ssl.TLSVersion.TLSv1_2.

https://docs.python.org/3/library/ssl.html#ssl.SSLContext.maximum_version

[tandoori_mql]

Hello again,

Alain Verleyen #:
Information is always useful, but in this case that will not help you anyway, as it's nothing under your control.

I would say it is useful when the MT5 folder of trusted CA certificates is accessible and I can add and remove certificates for example. But I want to focus more on the error that happens.

Alain Verleyen #:
There is no proof the problem is a certificate issue. The SSLV3_ALERT_ILLEGAL_PARAMETER seems to mean something else.

How can you estimate what this error means? I can not find anything in the documentation of OpenSSL and other sites on the web also don't offer something useful.

Alain Verleyen #:

https://docs.python.org/3/library/ssl.html#ssl.SSLContext.maximum_version

This is the only thing I can set apart from ssl.TLSVersion.TLSv1_3, which obviously allows all protocols, provided minimum_version is not set otherwise. But since all TLSVersions except for 1.2 and 1.3 are deprecated since 3.10 and all "no_$protocol" options that exclude certain protocols are also deprecated since 3.6/3.7, I don't see anything useful in that. So the only thing I can force my server to do is to only allow 1.2 or 1.3, but nothing else.

I would just go through all certificate requirements for all versions from SSLv2 to TLSv1.3 and maybe find something there by chance. Do you happen to know where I can find information on the certificate requirements per each protocol type? That is something I was not able to find until now.

Cheers,

tandoori