<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/Jennifer-first">Jennifer-first</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1708">#1708</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<h2 dir="auto" style="margin-top: 0; margin-bottom: 10px;" align="initial">
<a href="#description-of-problem" aria-hidden="true" class="anchor" id="user-content-description-of-problem" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Description of problem:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">When connecting to <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; margin-top: 0; font-weight: inherit; white-space: break-spaces; word-break: break-all; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: break-word; padding: 0.125rem 0.25rem;'>expired.badssl.com</code> using <code style='font-size: 90%; color: #18171d; word-wrap: break-word; border-radius: .25rem; background-color: #ececef; font-weight: inherit; white-space: break-spaces; word-break: break-all; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: break-word; padding: 0.125rem 0.25rem;'>gnutls-cli</code>, the handshake fails with a fatal TLS alert (alert code [40]) and the connection is aborted. The goal was to reproduce an SSL error scenario, and the observed behavior may indicate either expected behavior or unexpected handling by GnuTLS.Attached is my running script.<a href="https://gitlab.com/-/project/179611/uploads/6caa057315fd74924dcddd36314b3c70/test.py" data-canonical-src="/uploads/6caa057315fd74924dcddd36314b3c70/test.py" data-link="true" class="gfm">test.py</a></p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#version-of-gnutls-used" aria-hidden="true" class="anchor" id="user-content-version-of-gnutls-used" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Version of gnutls used:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">gnutls 3.7.3</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true" class="anchor" id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Ubuntu</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#how-reproducible" aria-hidden="true" class="anchor" id="user-content-how-reproducible" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>How reproducible:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">Steps to Reproduce:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 1rem; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">python3 test.py</li>
</ul>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#actual-results" aria-hidden="true" class="anchor" id="user-content-actual-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Actual results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">python3 test.py
STDOUT:
Processed 146 CA certificate(s).
Resolving 'expired.badssl.com:443'...
Connecting to '104.154.89.105:443'...
*** Received alert [40]: Handshake failed</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial">STDERR:
*** Fatal error: A TLS fatal alert has been received.</p>
<p dir="auto" style="color: #3a383f; margin: 0 0 1rem;" align="initial"><gl-emoji title="check mark button" data-name="white_check_mark" data-unicode-version="6.0" style="margin-top: 0;">✅</gl-emoji> REPRODUCTION SUCCESSFUL: SSL error observed.</p>
<h2 dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">
<a href="#expected-results" aria-hidden="true" class="anchor" id="user-content-expected-results" style="margin-top: 0; margin-left: -20px; text-decoration: none; outline: none; position: absolute; width: 20px;"></a>Expected results:</h2>
<p dir="auto" style="color: #3a383f; margin: 0;" align="initial">The connection should fail gracefully due to the expired certificate, but it is unclear whether the fatal alert [40] is expected or if GnuTLS should produce a more descriptive error (e.g., "certificate expired").</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1708">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/8ea7dbac6e9b4a6cb009c64244037d32/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/issues/1708 at 1746865058
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1708"}}</script>
</p>
</div>
</body>
</html>