Windows agent 2.10.4 -> 2.11.0 RC1 master: no shared cipher

[dnsmichi]

Describe the bug

Windows 2.10.4 Agent connects against 2.11.0 RC1 master resulting in no shared cipher error messages.

Mitigation

• openssl s_server -connect :5665 from the master (if reachable)
• sslscan on Linux or as exe on Windows to analyse the preferred cipher suite

Workaround

The master prefers the cipher suite and needs to offer AES256-GCM-SHA384.

Edit features-enabled/api.conf and add the cipher_list attribute with the following content from #7368.

object ApiListener "api" {

  cipher_list = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:AES256-GCM-SHA384"

  ticket_salt = TicketSalt
}

Fixes

Already fixed with #7369 - this adds to the list for patching 2.10.6 as well (and blocks the ECC draft in #7323). @lippserd @bobapple

References

ref/NC/627739

[dnsmichi]

This is for tracking only, workarounds and fixes already exist.

[dnsmichi]

Versions til 2.10.5 use OpenSSL 1.0.2n, that explains the missing ECDH cipher suites.