H3C Technologies H3C WX6000 Series Access Controllers - Manual (Page 642)

66-6
Displaying and Maintaining SSL
To do... Use the command... Remarks
Display SSL server policy
information
display ssl server-policy { policy-name | all }
Display SSL client policy
information
display ssl client-policy { policy-name | all }
Available in any view
Troubleshooting SSL
SSL Handshake Failure
Symptom
As the SSL server, the device fails to handshake with the SSL client.
Analysis
SSL handshake failure may result from the following causes:
z
No SSL server certificate exists, or the certificate is not trusted.
z
The server is expected to authenticate the client, but the SSL client has no certificate or the
certificate is not trusted.
z
The cipher suites used by the server and the client do not match.
Solution
1) You can issue the debugging ssl command and view the debugging information to locate the
problem:
z
If the SSL server has no certificate, request one for it.
z
If the server certificate cannot be trusted, install on the SSL client the root certificate of the CA that
issues the local certificate to the SSL server, or let the server requests a certificate from the CA that
the SSL client trusts.
z
If the SSL server is configured to authenticate the client, but the certificate of the SSL client does
not exist or cannot be trusted, request and install a certificate for the client.
2) You can use the display ssl server-policy command to view the cipher suite used by the SSL
server policy. If the cipher suite used by the SSL server does not match that used by the client, use
the ciphersuite command to modify the cipher suite of the SSL server.