Re: SSL connection between Apache and Tomcat failing
Lou Picciano <[email protected]> Fri, 17 Jul 2009 14:13:51 +0000 (UTC)
| Newsgroups | gmane.comp.apache.mod-ssl.user |
|---|---|
| Message-ID | <89989569.2619131247840031310.JavaMail.root@sz0093a.westchester.pa.mail.comcast.net> |
------=_Part_127361_115640072.1247840031309 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Iain:=20 Wow! Am I glad to hear from you! I've been wrestling with exactly this prob= lem - error on: OpenSSL: read 5/5 bytes from BIO - for a few weeks now; was= beginning to think I was losing my mind. (while we leave that possibility = aside for the moment(!),) here's what's different about our environment:=20 Apache/2.2.11 (Unix - Solaris SPARC) mod_ssl/2.2.11 OpenSSL/0.9.8k PHP/5.2.= 9 . We are using certificate authentication. Seeing this behavior under Fir= efox (Mac); haven't tried it using mobile browsers, though, presumably, you= may be using a Mozilla-based mobile browser... We've recently upgraded to = these current versions of Apache and OpenSSL, but the error behavior has no= t been impacted. The incessant prompting for certificate can be interrupted= by setting Firefox's Advanced-Encryption-When a server requests my certifi= cate-Select one automatically option. The above read error persists, howeve= r...=20 The primary impact is - apparently - that the SSL session is constantly re-= negotiated for GET of each page element; loading of a single page might gen= erate 8-10 prompts for the certificate. We have fiddled with various settin= gs for the Renogotiation buffer, including which buffer engine is used, its= size, etc., all to no avail. Some of the settings result in Apache configu= ration errors, so I wonder if we're into an Apache - or mod_ssl - 'black ho= le' region.=20 My quick research on this indicates that others have run into it, some have= simply ignored it, but none have solved it.=20 Hopefully we'll come up with something. Lou=20 ----- Original Message -----=20 From: "I Emsley (Iain)" <[email protected]>=20 To: [email protected]=20 Sent: Friday, July 17, 2009 8:56:23 AM GMT -05:00 US/Canada Eastern=20 Subject: SSL connection between Apache and Tomcat failing=20 I=E2=80=99ve got a website which uses Apache 2.2 as the front end with Tomc= at 5.5.23 as the backend and am using mod_ssl and mod_proxy to link to the = two together in Windows server 2003. Normally there isn=E2=80=99t an issue = with two servers serving the website but recently (and mainly with , it app= ears, mobile browsers), I=E2=80=99m getting the following errors:=20 i Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: S= SLv3 read finished A=20 [Fri Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1756): OpenSSL: Hand= shake: done=20 [Fri Jul 17 09:52:29 2009] [info] Connection: Client IP: 130.246.76.83, Pro= tocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits)=20 [Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1817): OpenSSL: read 5/5= bytes from BIO=20 ------=_Part_127361_115640072.1247840031309 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><style type=3D'text/css'>p { margin: 0; }</style></head><body><= div style=3D'font-family: Arial; font-size: 12pt; color: #000000'>Iain:<br>= <br>Wow! Am I glad to hear from you! I've been wrestling with e= xactly this problem - <span style=3D"text-decoration: underline; font-weigh= t: bold;">error on: OpenSSL: read 5/5 bytes from BIO</span> - for a few wee= ks now; was beginning to think I was losing my mind. (while we leave that p= ossibility aside for the moment(!),) here's what's different about our envi= ronment:<br><br><span>Apache/2.2.11 (Unix - Solaris SPARC) mod_ssl/2.2.11 O= penSSL/0.9.8k PHP/5.2.9</span>. We are using certificate authenticati= on. Seeing this behavior under Firefox (Mac); haven't tried it using mobile= browsers, though, presumably, you may be using a Mozilla-based mobile brow= ser... We've recently upgraded to these current versions of Apache an= d OpenSSL, but the error behavior has not been impacted. The incessan= t prompting for certificate can be interrupted by setting Firefox's Advance= d-Encryption-When a server requests my certificate-Select one automatically= option. The above read error persists, however...<br><br>The primary= impact is - apparently - that the SSL session is <span style=3D"font-style= : italic;">constantly</span> re-negotiated for GET of each page element; lo= ading of a single page might generate 8-10 prompts for the certificate.&nbs= p; We have fiddled with various settings for the Renogotiation buffer, incl= uding which buffer engine is used, its size, etc., all to no avail. S= ome of the settings result in Apache configuration errors, so I wonder if w= e're into an Apache - or mod_ssl - 'black hole' region.<br><br>My quick res= earch on this indicates that others have run into it, some have simply igno= red it, but none have solved it.<br><br>Hopefully we'll come up with someth= ing. Lou<br><br>----- Original Message -----<br>Fro= m: "I Emsley (Iain)" <[email protected]><br>To: modssl-users@mod= ssl.org<br>Sent: Friday, July 17, 2009 8:56:23 AM GMT -05:00 US/Canada East= ern<br>Subject: SSL connection between Apache and Tomcat failing<br><br> <style> <!-- /* Font Definitions */ @font-face =09{font-family:Calibri; =09panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal =09{margin:0cm; =09margin-bottom:.0001pt; =09font-size:11.0pt; =09font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink =09{mso-style-priority:99; =09color:blue; =09text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed =09{mso-style-priority:99; =09color:purple; =09text-decoration:underline;} span.EmailStyle17 =09{mso-style-type:personal-compose; =09font-family:"Calibri","sans-serif"; =09color:windowtext;} .MsoChpDefault =09{mso-style-type:export-only;} @page Section1 =09{size:612.0pt 792.0pt; =09margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.Section1 =09{page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> <div class=3D"Section1"> <p class=3D"MsoNormal">I=E2=80=99ve got a website which uses Apache 2.2 as = the front end with Tomcat 5.5.23 as the backend and am using mod_ssl and mod_proxy to link to the two together in Windows server 2003. Normally there isn=E2=80= =99t an issue with two servers serving the website but recently (and mainly with , = it appears, mobile browsers), I=E2=80=99m getting the following errors:</p> <p class=3D"MsoNormal">i Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(= 1760): OpenSSL: Loop: SSLv3 read finished A</p> <p class=3D"MsoNormal">[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1756): OpenSSL: Handshake: done</p> <p class=3D"MsoNormal">[Fri Jul 17 09:52:29 2009] [info] Connection: Client= IP: 130.246.76.83, Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits)</= p> <p class=3D"MsoNormal">[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1= 817): OpenSSL: read 5/5 bytes from BIO</p></div><br></div></body></html> ------=_Part_127361_115640072.1247840031309-- ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager [email protected]