Firefox 27. Что изменили в криптографии? Не работает SSL соединение.

Ошибка при установлении защищённого соединения При соединении с ххххххх произошла ошибка. SSL-узлу не удалось договориться о приемлемом наборе параметров безопасности. (Код ошибки: ssl_error_handshake_failure_alert)

Уфф... Мозги уже закипают.
Под QNX 4.25 скрипт сканера не работает корректно, сразу вываливается с ошибкой. Что в нем не так - это выше моих сил.

Про Апач нет ничего похожего, кроме упоминаний его в логах или конфигах.

скрытый текст

[Sat Jan 4 11:23:30 2014] gcache s[Sat Jan 4 11:23:30 2014] gcache started
[Sat Jan 4 11:23:30 2014] [notice] Apache/1.3.6 Ben-SSL/1.35 RTX/1.03 (Unix) rus/PL28.16 configured -- resuming normal operations

скрытый текст

# Load some randomness.
# This is loaded at startup, reading at most 1024 bytes from /dev/random
# The randomness will be _shared_ between all server instances. You can have
# as many of these as you want.
SSLRandomFile /www/srv.webmeteo/conf/rand.dat 1024

# And this one will be loaded before SSL is negotiated for each connection.
# Again, you can have as many of these as you want, and they will all be used
# at each connection.
SSLRandomFilePerConnection /www/srv.webmeteo/conf/rand.dat 1024

# Note that all SSL options can apply to virtual hosts.

# Disable SSL. Useful in combination with virtual hosts. Note that SSLEnable is
# now also supported.
SSLEnable

# Set the path for the global cache server executable.
# If this facility gives you trouble, you can disable it by setting
# CACHE_SESSIONS to FALSE in apache_ssl.c
SSLCacheServerPath /www/bin/gcache

# Set the global cache server port number, or path. If it is a path, a Unix
# domain socket is used. If a number, a TCP socket.
#SSLCacheServerPort logs/gcache_port
SSLCacheServerPort 1234

# Directory for the cache server to run in (in case of crashes). Optional.
SSLCacheServerRunDir /tmp

# Set the session cache timeout, in seconds (set to 15 for testing, use a
# higher value in real life)
SSLSessionCacheTimeout 15

# Set the CA certificate verification file (must be PEM encoded).
# (in addition to getenv("SSL_CERT_FILE"), I think).
SSLCACertificateFile /www/srv.webmeteo/conf/httpsd.pem

# Point SSLCertificateFile at a PEM encoded certificate.
# If the certificate is encrypted, then you will be prompted for a pass phrase.
# Note that a kill -1 will prompt again.
# A test certificate can be generated with "make certificate".
SSLCertificateFile /www/srv.webmeteo/conf/httpsd.pem

# Set SSLVerifyClient to:
# 0 if no certicate is required
# 1 if the client may present a valid certificate
# 2 if the client must present a valid certificate
# 3 if the client may present a valid certificate but it is not required to
# have a valid CA
SSLVerifyClient 2

# How deeply to verify before deciding they don't have a valid certificate
SSLVerifyDepth 2

# If you have enabled client cert exports (in buff.h) you need to use
# SSLExportClientCertificates to enable them. Note that the server still has to
# mess about with certs even if this is disabled (and exports are enabled)
# because the cert chain is received before we can know whether it is needed or
# not.
<Location /scripts>
SSLExportClientCertificates
</Location>

SSLExportClientCertificates

# Translate the client X509 into a Basic authorisation. This means that the
# standard Auth/DBMAuth methods can be used for access control. The user name
# is the "one line" version of the client's X509 certificate. Note that no
# password is obtained from the user. Every entry in the user file needs this
# password: xxj31ZMTZzkVA. See the code for further explanation.
SSLFakeBasicAuth

# List the ciphers that the client is permitted to negotiate. See the source
# for a definitive list. For example:
#SSLRequiredCiphers RC4-MD5:RC4-SHA:IDEA-CBC-MD5:DES-CBC3-SHA

# These two can be used per-directory to require or ban ciphers. Note that (at
# least in the current version) Apache-SSL will not attempt to renegotiate if a
# cipher is banned (or not required).
# You should probably at least ban the null encryption ciphers.
#SSLRequireCipher
SSLBanCipher NULL-MD5:NULL-SHA

# A home for miscellaneous rubbish generated by SSL. Much of it is duplicated
# in the error log file. Put this somewhere where it cannot be used for symlink
# attacks on a real server (i.e. somewhere where only root can write).
# Don't use this anymore! Now everything is logged in the error log.
#SSLLogFile /tmp/ssl.log

Установка защищённого соединения с этим узлом не удалась: отсутствуют общие алгоритм(ы) шифрования. (Код ошибки: ssl_error_no_cypher_overlap)

root@localhost:/home/user/Рабочий стол/cipherscan-master# openssl ciphers DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC2-CBC-MD5:RC4-SHA:RC4-MD5:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 root@localhost:/home/user/Рабочий стол/cipherscan-master# ./cipherscan -v www.google.com:443 Loading 0 ciphersuites from .Connecting to 'www.google.com:443' with ciphersuite 'ALL:COMPLEMENTOFALL' handshake failed, no ciphersuite was returned

root@localhost:/home/user/bin# ls /home/user/bin cipherscan openssl OpenSSL-LICENSE README.md top1m root@localhost:/home/user/bin# openssl ciphers DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DES-CBC3-MD5:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC2-CBC-MD5:RC4-SHA:RC4-MD5:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC2-CBC-MD5:EXP-RC4-MD5:EXP-RC4-MD5 root@localhost:/home/user/bin# openssl OpenSSL> ^C root@localhost:/home/user/bin# ./cipherscan -v www.google.com:443 Loading 0 ciphersuites from .Connecting to 'www.google.com:443' with ciphersuite 'ALL:COMPLEMENTOFALL' handshake failed, no ciphersuite was returned root@localhost:/home/user/bin#

Код:

Код:

Код:

Код:

Код:

Код:

Код:

Код: