wanna help me troubleshoot a tls handshake problem let's go ahead and get to it but
before we get into the packets let me tell you a little bit about the problem we had an issue where
some clients were able to successfully connect to a secure web server and some were not
so let's go ahead and take a look at the packets to really find out what was going on
all right so here this is just a standard thread a standard tcp conversation uh here
i can see i've got the cincinnati hack there's my handshake i'm establishing a connection to
port 443 and right after that as tls does is it then goes and establishes its handshake
that's usually where we see a client hello go to the server with a few different options and
then the server hello comes back continuing that handshake process so here we've got our client
hello and i can see that the client hello gets there the server comes back and says great thumbs
up i got your packet that's what this ack is okay i click that app i can see my check mark over here
right after that the server comes back and it does a tcp window update now you might be thinking oh
no this is a tcp problem we've got a window update hang on a second let's just investigate this for
a quick moment if i come and open this up in tcp here i can see that my window size let's
just check out that out here that says my window size is 12 but wait that's not the true window the
actual calculated window size is 61.44 if i look at the packet previous 76.80 so this just tells
me that there's a few bytes sitting in that buffer in that tcp receive buffer but i still have some
room to work with 6144 so that's why my eye is going to jump right over that i'm not going to
worry too much about the window update i might look at that later however boom fatal that looks
a lot worse doesn't it okay so let's go ahead and take a look at what this is talking about
all right let me open this up and i know i see some stuff up here in the info area of wireshark
but let's actually look deeper into the protocol okay so record layer fatal the description was
protocol version hmm so the server's coming back and saying nope i'm not talking to you because of
the protocol version okay there's our clue let's go back to the client hello what on earth are we
doing okay so client hello now one thing during the tls handshake that a client does is it's
going to offer to the server the different tls versions that it's able to support okay so ssl
3.0 tls 1.0 tls 1.1 1.2 1.3 but here if i see here the client is saying okay version tls 1.0
all right so that's an older version if i come down here into the client hello i see
that version again tls1.0 so i can see that i'm using tls 1.0 1.0 version and that client hello
and i don't have any other extensions where i'm advertising any other supported versions so that's
a pretty common thing that you'll see these days in the client hello you'll see it use one version
like 1.0 or 1.1 but really it's saying hey server just so you know i'm using these lower versions
just in case something stops me in the middle like a firewall that doesn't yet support tls 1.3 but
just so you know i can also support tls 1.2 and 1.3 okay so in that client hello we just don't see
the versions offered in an extension so this tls 1.0 here and here
is real that's what the client is able to do so that's why the server comes back and says nah nah
nah we're not we're not we're not playing those games look i'm not playing some old version of tls
that is known broken if you're not in the now using tls 1.2 or 1.3 we're not going to talk
right after that server says thanks been a nice day let's fin ack fin ack we're done and we've
torn down the connection so this was just a quick look at what happens if the client is
not able to support a modern version of tls here the server shut it down so in this case that's
exactly what we found some clients were using an older version of tls that needed to be updated
and then those clients were able to start working so i hope that this helped you
learn a little bit more about the tls handshake more to come absolutely thanks for stopping by