Connecting to a site with one of four different ciphers that are not in the default cipher list, and performing a post using the httpClient.
If using the the last cipher that was added to the list in the PSC_SSLCLIENT_CIPHERS variable, the post fails with SSL errors roughly 50% of the time.
If the cipher is moved higher in the list it succeeds 100% of the time.
List of added ciphers:
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES128-GCM-SHA256
The above list was added to the PSC_SSLCLIENT_CIPHERS environment variable, appended to the default list of ciphers from the documentation:
AES128-SHA256:DHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES256-SHA256:DHE-RSA-AES256-SHA256:AES128-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ADH-AES128-SHA256:ADH-AES128-GCM-SHA256:ADH-AES256-SHA256
The problem is that the ciphers above with ADH in their name are no longer supported by OpenSsl and the C code which is responsible for loading the ciphers from the PSC_SSLCLIENT_CIPHERS variable stops loading when it encounters the unsupported cipher.
Defect OCTA-38279 was logged to have the ADH ciphers removed from the list, but the problem that this causes is that more common ciphers will not be included in the ciphers used for requests if they are not listed in the PSC_SSLCLIENT_CIPHERS environment variable.
For example:
export PSC_SSLCLIENT_CIPHERS=AES128-SHA256:DHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES256-SHA256:DHE-RSA-AES256-SHA256:AES128-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ADH-AES128-SHA256:ADH-AES128-GCM-SHA256:ADH-AES256-SHA256
The above will load all ciphers but those with ADH.
If the ADH ciphers are placed at the beginning :
export PSC_SSLCLIENT_CIPHERS=ADH-AES128-SHA256:ADH-AES128-GCM-SHA256:ADH-AES256-SHA256:AES128-SHA256:DHE-RSA-AES128-SHA256:AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES256-SHA256:DHE-RSA-AES256-SHA256:AES128-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384
Client hello will not load any listed ciphers.
