?
Solved

Problem with IE and apache/openssl: ssl connection hangs upon initial load

Posted on 2013-01-31
4
Medium Priority
?
3,298 Views
Last Modified: 2013-02-09
Hi,
Hope someone can help me out.  Having a problem with an environment we are putting up

Using Apache 2.22
OpenSSL 0.9.8s 4 Jan 2012
(also tried 1.0.1)

Browser types IE 9 and IE 8

For some reason upon the initial load of the website, there is a "hang", seemingly during the handshake or something.

I tried this from my personal laptop and it did work no problem which is
IE 8 8.0.7601 (Windows 7)

Did not work from
IE 9 9.0.8112 (Windows 7)
and
IE 8 8.0.7601 (Windows 2008)

I couldn't find any differences in browser settings from my own to the IE on the actual client machines (sslv3 is checked, tls 1 is checked)

Doing a lot of google and most people seem to find success with the Browser Match like so:

BrowserMatch ".*MSIE [2-5].*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

BrowserMatch ".*MSIE [6-9].*" ssl-unclean-shutdown

Didn't work for me.

I also found some playing with the SSLCipherSuite changing
#       SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5  (default)
to
        SSLCipherSuite ALL:!ADH:!NULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2


Which also didn't work.

Unfortunately we cannot test with any other browser besides IE because the application is programmed to turn away any browsers that are not IE :(


Here is the apache error log on debug:


[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read finished A
[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1870): OpenSSL: Handshake: done
[Thu Jan 31 11:14:32 2013] [info] Connection: Client IP: 192.168.1.241, Protocol: TLSv1, Cipher: AES128-SHA (128/128 bits)



===========THIS IS WHERE THE DELAY IS ===========================
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#8f1f60 [mem: d1f5f3]
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] (70014)End of file found: SSL input filter read failed.
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_kernel.c(1884): OpenSSL: Write: SSL negotiation finished successfully
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] Connection closed to child 4 with standard shutdown (server webid.refugee.gov.tr:443)

Any ideas?

Thank you!
0
Comment
Question by:chanreayu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 37

Assisted Solution

by:ArneLovius
ArneLovius earned 400 total points
ID: 38843067
Is the certificate self signed, from a public CA, or from a private CA ?
If from a public CA, have the intermediate certificates been included ?
If from  a private CA is the CRL available to the client ?

Have you tested with Chrome and Firefox ?
0
 
LVL 16

Assisted Solution

by:grahamnonweiler
grahamnonweiler earned 1600 total points
ID: 38846849
We faced a similar problem and eventually (through trial and error) came to the below combination:


SSLProtocol -all +SSLv3
SSLHonorCipherOrder On

SSLCipherSuite RC4-SHA:HIGH:!ADH

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


This was on Apache 2.2.22 with OpenSSL 0.98
0
 
LVL 1

Accepted Solution

by:
chanreayu earned 0 total points
ID: 38851745
Hi,

ArneLovius: Cert is self signed.   Getting the cert worked fine in Firefox.

Grahamnonweiler: Thanks for the suggestions.  I will need to keep that documented for next time.

Our solution: In the end through a lot of trial and error we found that for the specific IE we were using we did this in the browser

Tools -> Internet Options -> Advanced

Uncheck "Check for server certificate revocation"

Thanks!
0
 
LVL 1

Author Closing Comment

by:chanreayu
ID: 38870809
We came up with the fix of changing IE settings after many hours of trial and error.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question