Solved

Problem with IE and apache/openssl: ssl connection hangs upon initial load

Posted on 2013-01-31
4
3,117 Views
Last Modified: 2013-02-09
Hi,
Hope someone can help me out.  Having a problem with an environment we are putting up

Using Apache 2.22
OpenSSL 0.9.8s 4 Jan 2012
(also tried 1.0.1)

Browser types IE 9 and IE 8

For some reason upon the initial load of the website, there is a "hang", seemingly during the handshake or something.

I tried this from my personal laptop and it did work no problem which is
IE 8 8.0.7601 (Windows 7)

Did not work from
IE 9 9.0.8112 (Windows 7)
and
IE 8 8.0.7601 (Windows 2008)

I couldn't find any differences in browser settings from my own to the IE on the actual client machines (sslv3 is checked, tls 1 is checked)

Doing a lot of google and most people seem to find success with the Browser Match like so:

BrowserMatch ".*MSIE [2-5].*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

BrowserMatch ".*MSIE [6-9].*" ssl-unclean-shutdown

Didn't work for me.

I also found some playing with the SSLCipherSuite changing
#       SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5  (default)
to
        SSLCipherSuite ALL:!ADH:!NULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2


Which also didn't work.

Unfortunately we cannot test with any other browser besides IE because the application is programmed to turn away any browsers that are not IE :(


Here is the apache error log on debug:


[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read finished A
[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1870): OpenSSL: Handshake: done
[Thu Jan 31 11:14:32 2013] [info] Connection: Client IP: 192.168.1.241, Protocol: TLSv1, Cipher: AES128-SHA (128/128 bits)



===========THIS IS WHERE THE DELAY IS ===========================
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#8f1f60 [mem: d1f5f3]
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] (70014)End of file found: SSL input filter read failed.
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_kernel.c(1884): OpenSSL: Write: SSL negotiation finished successfully
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] Connection closed to child 4 with standard shutdown (server webid.refugee.gov.tr:443)

Any ideas?

Thank you!
0
Comment
Question by:chanreayu
  • 2
4 Comments
 
LVL 37

Assisted Solution

by:ArneLovius
ArneLovius earned 100 total points
ID: 38843067
Is the certificate self signed, from a public CA, or from a private CA ?
If from a public CA, have the intermediate certificates been included ?
If from  a private CA is the CRL available to the client ?

Have you tested with Chrome and Firefox ?
0
 
LVL 16

Assisted Solution

by:grahamnonweiler
grahamnonweiler earned 400 total points
ID: 38846849
We faced a similar problem and eventually (through trial and error) came to the below combination:


SSLProtocol -all +SSLv3
SSLHonorCipherOrder On

SSLCipherSuite RC4-SHA:HIGH:!ADH

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


This was on Apache 2.2.22 with OpenSSL 0.98
0
 
LVL 1

Accepted Solution

by:
chanreayu earned 0 total points
ID: 38851745
Hi,

ArneLovius: Cert is self signed.   Getting the cert worked fine in Firefox.

Grahamnonweiler: Thanks for the suggestions.  I will need to keep that documented for next time.

Our solution: In the end through a lot of trial and error we found that for the specific IE we were using we did this in the browser

Tools -> Internet Options -> Advanced

Uncheck "Check for server certificate revocation"

Thanks!
0
 
LVL 1

Author Closing Comment

by:chanreayu
ID: 38870809
We came up with the fix of changing IE settings after many hours of trial and error.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In Solr 4.0 it is possible to atomically (or partially) update individual fields in a document. This article will show the operations possible for atomic updating as well as setting up your Solr instance to be able to perform the actions. One major …
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question