Table of Contents
- 3 PSK problems
- PSK contains an odd number of hex-digits
- PSK identity string longer than 128 bytes is passed to GnuTLS
- PSK longer than 32 bytes is passed to mbed TLS (PolarSSL)
- Same PSK identity but different PSK values used by communicating components (example with OpenSSL)
- Too long PSK value used with OpenSSL 1.1.1
3 PSK problems
PSK contains an odd number of hex-digits
Proxy or agent does not start, message in the proxy or agent log:
PSK identity string longer than 128 bytes is passed to GnuTLS
In TLS client side log:
In TLS server side log.
PSK longer than 32 bytes is passed to mbed TLS (PolarSSL)
In any Zabbix log:
Same PSK identity but different PSK values used by communicating components (example with OpenSSL)
In connecting-side log:
...[connect] TCP successful, cannot establish TLS to [[xx.xx.xx.xx]:xxx]: SSL_connect() returned SSL_ERROR_SSL: file s3_pkt.c line 1472: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac: SSL alert number 20: TLS read fatal alert "bad record mac"In accepting-side log:
...failed to accept an incoming connection: from xx.xx.xx.xx: TLS handshake returned error code 1: file s3_pkt.c line 532: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac: TLS write fatal alert "bad record mac"Too long PSK value used with OpenSSL 1.1.1
In connecting-side log:
...OpenSSL library (version OpenSSL 1.1.1 11 Sep 2018) initialized
...
...In zbx_tls_connect(): psk_identity:"PSK 1"
...zbx_psk_client_cb() requested PSK identity "PSK 1"
...End of zbx_tls_connect():FAIL error:'SSL_connect() set result code to SSL_ERROR_SSL: file ssl\statem\extensions_clnt.c line 801: error:14212044:SSL routines:tls_construct_ctos_early_data:internal error: TLS write fatal alert "internal error"'In accepting-side log:
This problem typically arises when upgrading OpenSSL from 1.0.x or 1.1.0 to 1.1.1 and if the PSK value is longer than 512-bit (64-byte PSK, entered as 128 hexadecimal digits).
See also: Value size limits