{"action":"opened","issue":{"url":"https://api.github.com/repos/PeterMosmans/openssl/issues/13","labels_url":"https://api.github.com/repos/PeterMosmans/openssl/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/PeterMosmans/openssl/issues/13/comments","events_url":"https://api.github.com/repos/PeterMosmans/openssl/issues/13/events","html_url":"https://github.com/PeterMosmans/openssl/issues/13","id":64771086,"number":13,"title":"ticket hints fail with ECDHE-RSA-AES256-SHA384","user":{"login":"jvehent","id":415617,"avatar_url":"https://avatars.githubusercontent.com/u/415617?v=3","gravatar_id":"","url":"https://api.github.com/users/jvehent","html_url":"https://github.com/jvehent","followers_url":"https://api.github.com/users/jvehent/followers","following_url":"https://api.github.com/users/jvehent/following{/other_user}","gists_url":"https://api.github.com/users/jvehent/gists{/gist_id}","starred_url":"https://api.github.com/users/jvehent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvehent/subscriptions","organizations_url":"https://api.github.com/users/jvehent/orgs","repos_url":"https://api.github.com/users/jvehent/repos","events_url":"https://api.github.com/users/jvehent/events{/privacy}","received_events_url":"https://api.github.com/users/jvehent/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-27T14:19:11Z","updated_at":"2015-03-27T14:19:11Z","closed_at":null,"body":"I noticed a strange behavior in cipherscan's output: ticket hints always fail with cipher ECDHE-RSA-AES256-SHA384 since I upgraded the openssl binary last week. It may be an error in the build options I used, or a bug in upstream openssl. I figured I'd file here first for verification before escalating to openssl.\r\n\r\nCustom build with AES128-SHA: ticket lifetime found\r\n```bash\r\n$ ./openssl s_client -connect google.com:443 -cipher 'AES128-SHA' 2>&1 <<<Q|grep 'ticket lifetime'\r\n    TLS session ticket lifetime hint: 100800 (seconds)\r\n```\r\nCustom build with ECDHE-RSA-AES256-SHA384: no ticket lifetime found\r\n```bash\r\n$ ./openssl s_client -connect google.com:443 -cipher 'ECDHE-RSA-AES256-SHA384' 2>&1 <<<Q|grep 'ticket lifetime'\r\n```\r\nStock Fedora21 build with ECDHE-RSA-AES256-SHA384: ticket lifetime found\r\n```\r\n$ openssl s_client -connect google.com:443 -cipher 'ECDHE-RSA-AES256-SHA384' 2>&1 <<<Q|grep 'ticket lifetime'    TLS session ticket lifetime hint: 100800 (seconds)\r\n```\r\n\r\nCustom build version & options:\r\n```bash\r\n$ ./openssl version -a\r\nOpenSSL 1.0.2-chacha (1.0.2b-dev)\r\nbuilt on: reproducible build, date unspecified\r\nplatform: linux-x86_64\r\noptions:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) \r\ncompiler: gcc -I. -I.. -I../include  -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_EXPERIMENTAL_JPAKE -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM\r\nOPENSSLDIR: \"/usr/local/ssl\"\r\n```\r\n\r\nStock fedora 21 build version & options:\r\n```bash\r\n$ openssl version -a\r\nOpenSSL 1.0.1k-fips 8 Jan 2015\r\nbuilt on: Fri Jan  9 10:39:16 2015\r\nplatform: linux-x86_64\r\noptions:  bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) idea(int) blowfish(idx) \r\ncompiler: -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches  -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM\r\nOPENSSLDIR: \"/etc/pki/tls\"\r\nengines:  rdrand dynamic \r\n```"}}