3

I'm trying to connecto to this url, just using a get request. Goberment page But always get the error EIdOSSLConnectError "Error connecting with SSL"

The code I use, is this, it works with other pages, but not this one

IdHTTP1.HandleRedirects := true;
IdHTTP1.AllowCookies := true;
IdHTTP1.IOHandler := TIdSSLIOHandlerSocket.Create(IdHTTP1);
IdHTTP1.CookieManager := TIdCookieManager.Create(IdHTTP1);
with TIdSSLIOHandlerSocket(IdHTTP1.IOHandler) do begin
  SSLOptions.Method := sslvTLSv1;
  SSLOptions.Mode := sslmUnassigned;
  SSLOptions.VerifyMode := [];
  SSLOptions.VerifyDepth := 0;
  PassThrough := True;
end;
IdHttp1.Request.UserAgent := 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0';
IdHTTP1.RedirectMaximum := 30;
sHtml := IdHTTP1.Get('https://loginc.mat.sat.gob.mx/nidp/app/login?id=XACCertiSAT&sid=0&option=credential&sid=0');//<----Error here

Delphi 7, Indy 9.00.10

Thanks for any advice

6
  • 4
    You are using an extremely old version of Indy 9 (the last version was 9.0.50). Indy 9 requires customized (and old) OpenSSL DLLs, it does not support modern OpenSSL versions. Please upgrade to Indy 10 and use the latest official OpenSSL 1.0.2 DLLs, which you can get from Indy's Fulgan mirror. Aug 15, 2017 at 17:17
  • Your RedirectMaximum value seems to expect redirects almost across the whole Universe (42 is the maximum the Universe accepts :)
    – Victoria
    Aug 15, 2017 at 18:13
  • I did update to 10.6.2.0, now I get this error: "Error connecting with SSL error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure"
    – crono81
    Aug 15, 2017 at 19:05
  • Thanks Remy Lebeau, with the update did it work, the problems was, as Bob3411 mentioned, the SSLOptions.Method := sslvTLSv1; changed to SSLOptions.Method := sslvSSLv23; and also using the openssl dll openssl-1.0.2-i386-win32.zip, openssl-1.0.2-x64_86-win64.zip didn't work. Victoria, I use 30 redirects, because, I did not know how many times would do it :p. Off topic, Remy, have you installed reportmanager 2_7 with indy 10? thanks guys
    – crono81
    Aug 15, 2017 at 21:23
  • Dont use the SSLOptions.Method property directly (it is deprecated, so pretend it doesn't exist), use the SSLOptions.SSLVersions property instead. If you enable multiple versions (like [sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2]), the Method will be set to sslvSSLv23 for you (but that is an implementation detail). Setting Method to sslvSSLv23 is the same as setting SSLVersions to [sslvSSLv2,sslvSSLv3,sslvTLSv1,sslvTLSv1_1,sslvTLSv1_2]. Aug 16, 2017 at 19:42

1 Answer 1

1

It seems that site wants TLS v1.2, since that is what gets negotiated when I go there with a browser.

Also, if in my PaleMoon browser I next go to about:config and set the pref named security.tls.version.max to 1, I revisit your url then wit TLS v1.0 and I get: Secure Connection Failed An error occurred during a connection to loginc.mat.sat.gob.mx. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)

However, other sites I tried (such as banks) still work okay with TLS v1 set that way. It seems your target site is finicky, so I'd try adjusting your line: SSLOptions.Method := sslvTLSv1;

1
  • and this site says: Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available on it. Additions like AES-GCM, and SHA256 to replace MD5-SHA-1 are unavailable to a TLS 1.0 client as well as many more modern cipher suites. howsmyssl.com
    – Bob3411
    Aug 15, 2017 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.