Note that there are some explanatory texts on larger screens.

plurals
  1. POUnclear TLS Rec Layer-1 Encrypted Alert
    primarykey
    data
    text
    <p>I am trying to access a remote webservice from an asp.net application in an iis 6 server to a remote webserver. As I wasn't able to connect, I used MS Network Monitor to look over what was happening.</p> <p>This is the TLS progress</p> <pre><code>2 15:26:31 14.03.2013 0.0000000 yyy.yyy.yyy.yyy XXX.XXX.XXX.XXX TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:4, SSLVersionSelector:3, TCP:2, IPv4:1} 3 15:26:31 14.03.2013 0.0312500 XXX.XXX.XXX.XXX yyy.yyy.yyy.yyy TLS TLS:TLS Rec Layer-1 HandShake: Server Hello.; TLS Rec Layer-2 HandShake: Certificate. {TLS:4, SSLVersionSelector:3, TCP:2, IPv4:1} 4 15:26:31 14.03.2013 0.0312500 yyy.yyy.yyy.yyy XXX.XXX.XXX.XXX TLS TLS:TLS Rec Layer-1 HandShake: Certificate. Client Key Exchange. Certificate Verify.; TLS Rec Layer-2 Cipher Change Spec; TLS Rec Layer-3 HandShake: Encrypted Handshake Message. {TLS:4, SSLVersionSelector:3, TCP:2, IPv4:1} 5 15:26:31 14.03.2013 0.0468750 XXX.XXX.XXX.XXX yyy.yyy.yyy.yyy TLS TLS:TLS Rec Layer-1 Cipher Change Spec; TLS Rec Layer-2 HandShake: Encrypted Handshake Message. {TLS:4, SSLVersionSelector:3, TCP:2, IPv4:1} 6 15:26:31 14.03.2013 0.0781250 XXX.XXX.XXX.XXX yyy.yyy.yyy.yyy TLS TLS:TLS Rec Layer-1 Encrypted Alert {TLS:4, SSLVersionSelector:3, TCP:2, IPv4:1} </code></pre> <p>And this is final TLS transaction with the alert</p> <pre><code> - TlsRecordLayer: TLS Rec Layer-1 Encrypted Alert ContentType: Encrypted Alert - Version: TLS 1.0 Major: 3 (0x3) Minor: 1 (0x1) Length: 18 (0x12) EncryptedData: Binary Large Object (18 Bytes) </code></pre> <p>And finaly this is the hex dump for the alert part.</p> <pre><code>15 03 01 00 12 CE CA A3 1C C9 44 5C AC A2 3C BB 3C F3 F9 8A A6 4F 22 </code></pre> <p>According to <a href="http://en.wikipedia.org/wiki/Transport_Layer_Security#Alert_protocol" rel="nofollow">http://en.wikipedia.org/wiki/Transport_Layer_Security#Alert_protocol</a> I tried to decode the meaning</p> <pre><code>15 = 21 dec &lt;- always 21 03 01 = major and minor Version 00 12 = lentgh </code></pre> <p>And now it gets weird. Normaly the next two bytes should be the level and description of the alert. But they make no sense. Beside that, they differ every trace I run. While the front part stays constantly the same.</p> <p>Any ideas how i can decrypt the alert? </p> <p>My first thought was that the other side may not allow TLS 1, while IIS 6 only supports TLS 1 (atleast that is what i thougt). </p> <p>Thanks alot in advanced</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload