8

community/AW_Blog: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure in magento blog aheadwork instalation

Navin Parmar
  • 167
  • 1
  • 1
  • 9
  • How ancient is that AheadWorks 3rd party module? Sounds like a curl transaction was hardcoded to use SSL V3 instead of negotiating for a compatible connection. Sounds like you need to contact them for an upgrade. – Fiasco Labs Feb 20 '15 at 06:56
  • i have already upgrade version and i find that error while install any extention in magento connect manager please help me if u have solution – Navin Parmar Feb 20 '15 at 07:12
  • Sorry, didn't connect `AheadWork installation' with Magento Connect. Related issue over here: http://stackoverflow.com/questions/26759383/ssl-error-can-not-change-to-tls – Fiasco Labs Feb 21 '15 at 18:29
  • Does Magento plan on addressing this server-side? Apparently becoming a common problem. Not sure if it only affects 1.9.1.0 or additional versions but I've experienced it twice now, with two different extensions on two different environments. http://magento.stackexchange.com/questions/58421/strange-error-when-installing-extension-over-magento-connect/58422#58422 – sparecycle Feb 23 '15 at 21:35

4 Answers4

12

It seems that Magento finally got around to Poodle fixes and disabled SSLV3 on Magento Connect. But in a left-hand, right-hand disconnect type thing, forgot that the downloader/ software they provide has SSLV3 issues in some curl requests it uses and didn't provide a patch.

downloader/lib/Mage/HTTP/Client/Curl.php is the affected file and a curl request needs to be modified to request TLS. The lines look something like this:

$this->curlOption(CURLOPT_URL, $uri);
$this->curlOption(CURLOPT_SSL_VERIFYPEER, FALSE);
$this->curlOption(CURLOPT_SSL_VERIFYHOST, 2);

Add your own curl option for TLSV1 as follows:

$this->curlOption(CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

Note that this isn't in app/core or lib, but over in downloader/lib

Fiasco Labs
  • 6,457
  • 3
  • 32
  • 43
  • So if somebody knows how to write a module to patch stuff in `downloader\lib`, please feel free to explain it instead of a useless "don't modify core files" comment. Also, "don't use connect" isn't a valid comment as some modules are only available through command line `mage` for me **to download them for manual install**. – Fiasco Labs Feb 21 '15 at 19:15
2

This is an error related to Magento Connect updating their server to not allow SSLV3, but Magento still trying to use it to connect. I have just built a fix. You can download it here: https://www.dwdonline.com/blog/fix-magento-error14077410ssl-routinesssl23_get_server_hellosslv3-alert-handshake-failure.html. Hope that helps!

Philip Deatherage
  • 190
  • 1
  • 9
2

I had a client running PHP 5.4 on Windows Server 2003, which uses OpenSSL 0.9.8zf at the time of writing. I upgraded to OpenSSL 1.0.1p by downloading the latest files and replacing libeay32.dll and ssleay32.dll in the PHP root directory. This seems to have resolved my particular issue.

E.J. Sexton
  • 21
  • 2
0

In my case I had PHP 5.3.5 which came with OPENSSL 0.9.8 and I had same issue. Upgraded to PHP 7, which came with updated version of OPENSSL fixed the problem.

burgur
  • 50
  • 5