Solved

Problem with IE and apache/openssl: ssl connection hangs upon initial load

Posted on 2013-01-31
4
3,198 Views
Last Modified: 2013-02-09
Hi,
Hope someone can help me out.  Having a problem with an environment we are putting up

Using Apache 2.22
OpenSSL 0.9.8s 4 Jan 2012
(also tried 1.0.1)

Browser types IE 9 and IE 8

For some reason upon the initial load of the website, there is a "hang", seemingly during the handshake or something.

I tried this from my personal laptop and it did work no problem which is
IE 8 8.0.7601 (Windows 7)

Did not work from
IE 9 9.0.8112 (Windows 7)
and
IE 8 8.0.7601 (Windows 2008)

I couldn't find any differences in browser settings from my own to the IE on the actual client machines (sslv3 is checked, tls 1 is checked)

Doing a lot of google and most people seem to find success with the Browser Match like so:

BrowserMatch ".*MSIE [2-5].*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

BrowserMatch ".*MSIE [6-9].*" ssl-unclean-shutdown

Didn't work for me.

I also found some playing with the SSLCipherSuite changing
#       SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5  (default)
to
        SSLCipherSuite ALL:!ADH:!NULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2


Which also didn't work.

Unfortunately we cannot test with any other browser besides IE because the application is programmed to turn away any browsers that are not IE :(


Here is the apache error log on debug:


[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read finished A
[Thu Jan 31 11:14:32 2013] [debug] ssl_engine_kernel.c(1870): OpenSSL: Handshake: done
[Thu Jan 31 11:14:32 2013] [info] Connection: Client IP: 192.168.1.241, Protocol: TLSv1, Cipher: AES128-SHA (128/128 bits)



===========THIS IS WHERE THE DELAY IS ===========================
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 5 bytes expected to read on BIO#8f1f60 [mem: d1f5f3]
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] (70014)End of file found: SSL input filter read failed.
[Thu Jan 31 11:14:47 2013] [debug] ssl_engine_kernel.c(1884): OpenSSL: Write: SSL negotiation finished successfully
[Thu Jan 31 11:14:47 2013] [info] [client 192.168.1.241] Connection closed to child 4 with standard shutdown (server webid.refugee.gov.tr:443)

Any ideas?

Thank you!
0
Comment
Question by:chanreayu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 37

Assisted Solution

by:ArneLovius
ArneLovius earned 100 total points
ID: 38843067
Is the certificate self signed, from a public CA, or from a private CA ?
If from a public CA, have the intermediate certificates been included ?
If from  a private CA is the CRL available to the client ?

Have you tested with Chrome and Firefox ?
0
 
LVL 16

Assisted Solution

by:grahamnonweiler
grahamnonweiler earned 400 total points
ID: 38846849
We faced a similar problem and eventually (through trial and error) came to the below combination:


SSLProtocol -all +SSLv3
SSLHonorCipherOrder On

SSLCipherSuite RC4-SHA:HIGH:!ADH

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


This was on Apache 2.2.22 with OpenSSL 0.98
0
 
LVL 1

Accepted Solution

by:
chanreayu earned 0 total points
ID: 38851745
Hi,

ArneLovius: Cert is self signed.   Getting the cert worked fine in Firefox.

Grahamnonweiler: Thanks for the suggestions.  I will need to keep that documented for next time.

Our solution: In the end through a lot of trial and error we found that for the specific IE we were using we did this in the browser

Tools -> Internet Options -> Advanced

Uncheck "Check for server certificate revocation"

Thanks!
0
 
LVL 1

Author Closing Comment

by:chanreayu
ID: 38870809
We came up with the fix of changing IE settings after many hours of trial and error.
0

Featured Post

Ready to trade in that old firewall?

Whether you need to trade-up to a shiny new Firebox or just ready to upgrade from whatever appliance you're using now, WatchGuard has the right appliance for you! Find your perfect Firebox today with appliance sizing tool!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

So you need a certificate so you can offer SSL encryption.  But which one should you get?  There are so many choices out there! Here is a generic overview of the main types of SSL certificates sold by the majority of commercial Certification Auth…
Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question