title: OpenSSL KEYUPDATE and "SSL_key_update:wrong ssl version"
body: <p>I am using Ubuntu 19.04 which ships with OpenSSL 1.1.1b. The system info is below. I am encountering <em><code>SSL_key_update:wrong ssl version</code></em> when transferring large docs during <em><code>KEYUPDATE</code></em>.</p>
  
  <p>I am starting my server with:</p>
  
  <pre><code>openssl s_server -accept 443 -cert /app/keys/cert.pem  -key /app/keys/private.key
  </code></pre>
  
  <p>I am connecting to the server with the following command using AES128:</p>
  
  <pre><code>openssl s_client -connect localhost:443 -cipher AES128-GCM-SHA256 -tls1_2
  </code></pre>
  
  <p>Sometimes it works, particularly if I am sending less than 100KB. However, with larger transfers it usually stops with:</p>
  
  <pre><code>KEYUPDATE
  140048546800768:error:1420310A:SSL routines:SSL_key_update:wrong ssl version:../ssl/ssl_lib.c:2090:
  </code></pre>
  
  <p><a href="https://github.com/boostorg/beast/issues/1467" rel="nofollow noreferrer">Others have seen this too</a> but they don't seem to conclude which aspect of the configuration is causing the problem.</p>
  
  <p>Interestingly, if I run an older openssl 1.1.0h-fips <code>s_client</code> against this same 1.1.1b server, it works just fine when using the same <code>-cipher AES128-GCM-SHA256 -tls1_2</code> options. And in fact it says:</p>
  
  <pre><code>Protocol  : TLSv1.2
  Cipher    : AES128-GCM-SHA256
  </code></pre>
  
  <p>As did the 1.1.1b client... it's just that the 1.1.1b client doesn't seem to be working.</p>
  
  <p>What is the problem, and how do I fix it?</p>
  
  <hr>
  
  <p>Here is the system info:</p>
  
  <pre><code>cli5# openssl version -a
  OpenSSL 1.1.1b  26 Feb 2019
  built on: Wed Apr 17 16:50:04 2019 UTC
  platform: debian-amd64
  options:  bn(64,64) rc4(16x,int) des(int) blowfish(ptr) 
  compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-FmdPCA/openssl-1.1.1b=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
  OPENSSLDIR: "/usr/lib/ssl"
  ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
  Seeding source: os-specific
  cli5# cat /proc/version
  Linux version 5.0.0-17-generic (buildd@lcy01-amd64-015) (gcc version 8.3.0 (Ubuntu 8.3.0-6ubuntu1)) #18-Ubuntu SMP Tue Jun 4 15:34:08 UTC 2019
  cli5#
  </code></pre>