Cannot handshake with speed.hetzner.de about utls

[gaukas]

Unfortunately FAKE_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9F) is not a real cipher suite supported cipher suite by uTLS. Being a FAKE_ cipher means, uTLS supports advertising it in the ClientHello but will not be able to work with it.

utls/u_common.go

Line 65 in 30f5a69

FAKE_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = uint16(0x009f)

Would you be interested in trying to implement it? I am open to a PR, but here is a warning: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 is a weak cipher in TLS 1.2 and has been deprecated. Even if someone comes with a PR, it will not be merged into uTLS until a // Deprecated: flag is properly added.

[gaukas]

Just curious, is it that your server or someone else's server preferring a weak cipher? A more proper way in terms of security to handle this, instead of connecting to the server WITH the 0x009f cipher, is to notify the admin about this vulnerability.

(Of course, unless it is you trying to break the known weak ciphers, then have fun!)

[let4be]

It's someone else's server I'm trying to connect to.
(Curl's clienthello)

[gaukas]

In that case, it is super weird and vulnerable. Possibly it is running an outdated TLS server. But for now, unfortunately I'm afraid there's no proper workaround to allow you to handshake with something that uTLS does not really implement.