Re: error in SSLv2/v3 read client hello A

I am still stack with the same issue :

[Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1875): OpenSSL:
Handshake: start
[Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1883): OpenSSL:
Loop: before accept initialization
[Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1893): OpenSSL:
Write: SSLv3 read client hello A
[Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1912): OpenSSL:
Exit: error in SSLv3 read client hello A
[Tue Nov 24 16:56:15 2009] [error] [client 194.2.193.253] Re-negotiation
handshake failed: Not accepted by client!?
[Tue Nov 24 16:56:23 2009] [debug] ssl_engine_io.c(1869): OpenSSL: I/O
error, 5 bytes expected to read on BIO#7f313d364fc0 [mem: 7f313d8641a0]

I renewed one more time all my certificates, so I don't think there is
anything wrong with it.
My apache configuration hasn't changed :
<Directory /secured>
 SSLRequireSSL
 SSLVerifyClient require
 SSLVerifyDepth 1
 Order allow,deny
 allow from All
</Directory>

And any browser (Firefox, Opera) fail so I don't think it is a browser
issue.
Of course, I imported the CA and the client certificate...

And still no prompt for the client certificate...

Really no hint ? Could it be a bug in the distro package ?

Thanks.

On Mon, 23 Nov 2009 01:29:30 +0100, Jean-Christophe Baptiste
<[email protected]> wrote:
> Hi all,
>=20
> I have been using client certificate for a while (more than 2 years)
> successfuly.
>=20
> But now, after migrating a server, I am stuck with a problem that I hav=
e
> no idea how to handle.
> I just spent 10 hours googling around and reading the doc without
> finding any clue.
>=20
> On my new set-up, the web browser seems to reject the negociation :
>=20
> [Sun Nov 22 22:51:36 2009] [info] [client ::1] Connection to child 2
> established (server www.***.net:443)
> [Sun Nov 22 22:51:36 2009] [info] Seeding PRNG with 656 bytes of entrop=
y
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1875): OpenSSL:
> Handshake: start
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1883): OpenSSL:
> Loop: before/accept initialization
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1858): OpenSSL: read
> 11/11 bytes from BIO#7f35d1213840 [mem: 7f35d1218f00] (BIO dump follows=
)
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1791):
>
+------------------------------------------------------------------------=
-+
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1830): | 0000: 4f 50
> 54 49 4f 4e 53 20-2a 20 48                 OPTIONS * H      |
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1836):
>
+------------------------------------------------------------------------=
-+
> [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1912): OpenSSL:
> Exit: error in SSLv2/v3 read client hello A
> [Sun Nov 22 22:51:36 2009] [info] [client ::1] SSL library error 1 in
> handshake (server www.***.net:443)
> [Sun Nov 22 22:51:36 2009] [info] SSL Library Error: 336027900
> error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
> speaking not SSL to HTTPS port!?
> [Sun Nov 22 22:51:36 2009] [info] [client ::1] Connection closed to
> child 2 with abortive shutdown (server www.***.net:443)
>=20
> I have tried a bund of different settings. Of course, I re-generated
> several times all the certificates, from the CA to the client.
> Both the CA and the client were imported into the web browser.
>=20
> The mod-ssl settings are in no point different from the previous
> machine, so am I missing ?
>=20
> So any help, any hint would be greatly appreciated.
>=20
> Thank you in advance,
>=20
> Regards,
> Jean-Christophe

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]