Re: Cannot connect with GnuTLS (OpenSSL is OK) "Decryption has failed" "Bad record MAC"

[Nikos Mavrogiannopoulos]

On 01/07/2013 10:16 PM, Stephane Bortzmeyer wrote:

> After I renewed a X.509 certificate, I can no longer connect to
> <https://svn.generic-nic.net/NIC-generique/iana/whois/> (which is an
> Apache using GnuTLS) with a client using GnuTLS (clients using OpenSSL
> are OK).
> 
> % openssl s_client -connect svn.generic-nic.net:443


btw. openssl cannot connect either. It connects because the command you
try obtains a different certificate from the one offered to gnutls which
uses server name indication. Try adding -servername svn.generic-nic.net
to the openssl command to the see the failure. Are you sure the server
certificate matches the server private key?

regards,
Nikos