Re: error in SSLv2/v3 read client hello A

--=-yMWJ+M7XABLVfcLwL4++
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I continue talking to myself about it.

Just to let people know that I submitted a bug to openSUSE, because it
took me less than 5 minutes to get a blank Debian virtual machine to
work with the exact same certificates, virtual host configuration and
browser.

There is definitely something weired...


Le mardi 24 novembre 2009 =C3=A0 17:24 +0100, Jean-Christophe Baptiste a
=C3=A9crit :
> I am still stack with the same issue :
>=20
> [Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1875): OpenSSL:
> Handshake: start
> [Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1883): OpenSSL:
> Loop: before accept initialization
> [Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1893): OpenSSL:
> Write: SSLv3 read client hello A
> [Tue Nov 24 16:56:15 2009] [debug] ssl_engine_kernel.c(1912): OpenSSL:
> Exit: error in SSLv3 read client hello A
> [Tue Nov 24 16:56:15 2009] [error] [client 194.2.193.253] Re-negotiation
> handshake failed: Not accepted by client!?
> [Tue Nov 24 16:56:23 2009] [debug] ssl_engine_io.c(1869): OpenSSL: I/O
> error, 5 bytes expected to read on BIO#7f313d364fc0 [mem: 7f313d8641a0]
>=20
> I renewed one more time all my certificates, so I don't think there is
> anything wrong with it.
> My apache configuration hasn't changed :
> <Directory /secured>
>  SSLRequireSSL
>  SSLVerifyClient require
>  SSLVerifyDepth 1
>  Order allow,deny
>  allow from All
> </Directory>
>=20
> And any browser (Firefox, Opera) fail so I don't think it is a browser
> issue.
> Of course, I imported the CA and the client certificate...
>=20
> And still no prompt for the client certificate...
>=20
> Really no hint ? Could it be a bug in the distro package ?
>=20
> Thanks.
>=20
> On Mon, 23 Nov 2009 01:29:30 +0100, Jean-Christophe Baptiste
> <[email protected]> wrote:
> > Hi all,
> >=20
> > I have been using client certificate for a while (more than 2 years)
> > successfuly.
> >=20
> > But now, after migrating a server, I am stuck with a problem that I hav=
e
> > no idea how to handle.
> > I just spent 10 hours googling around and reading the doc without
> > finding any clue.
> >=20
> > On my new set-up, the web browser seems to reject the negociation :
> >=20
> > [Sun Nov 22 22:51:36 2009] [info] [client ::1] Connection to child 2
> > established (server www.***.net:443)
> > [Sun Nov 22 22:51:36 2009] [info] Seeding PRNG with 656 bytes of entrop=
y
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1875): OpenSSL:
> > Handshake: start
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1883): OpenSSL:
> > Loop: before/accept initialization
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1858): OpenSSL: read
> > 11/11 bytes from BIO#7f35d1213840 [mem: 7f35d1218f00] (BIO dump follows=
)
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1791):
> >
> +------------------------------------------------------------------------=
-+
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1830): | 0000: 4f 50
> > 54 49 4f 4e 53 20-2a 20 48                 OPTIONS * H      |
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_io.c(1836):
> >
> +------------------------------------------------------------------------=
-+
> > [Sun Nov 22 22:51:36 2009] [debug] ssl_engine_kernel.c(1912): OpenSSL:
> > Exit: error in SSLv2/v3 read client hello A
> > [Sun Nov 22 22:51:36 2009] [info] [client ::1] SSL library error 1 in
> > handshake (server www.***.net:443)
> > [Sun Nov 22 22:51:36 2009] [info] SSL Library Error: 336027900
> > error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol
> > speaking not SSL to HTTPS port!?
> > [Sun Nov 22 22:51:36 2009] [info] [client ::1] Connection closed to
> > child 2 with abortive shutdown (server www.***.net:443)
> >=20
> > I have tried a bund of different settings. Of course, I re-generated
> > several times all the certificates, from the CA to the client.
> > Both the CA and the client were imported into the web browser.
> >=20
> > The mod-ssl settings are in no point different from the previous
> > machine, so am I missing ?
> >=20
> > So any help, any hint would be greatly appreciated.
> >=20
> > Thank you in advance,
> >=20
> > Regards,
> > Jean-Christophe

--=-yMWJ+M7XABLVfcLwL4++
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Ceci est une partie de message
 =?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.12 (GNU/Linux)

iQIcBAABAgAGBQJLDFIuAAoJEEElXOw26xO+eOUP/3wYLMd2pkOggOFl/hvNCE62
0qwYNXIJNXv6otirSY7S1tUWlAMpvkK40rX4IsXlCemQOBVsEEdnunfOpzDruD2l
eGWg3kLXZNyaRmYNYuzjNjWz3GbvdYVTLXGvZToHqkFzGC7OCCeDA5nr6ae0T6Zq
hEIkWIMcoYUuhRR6/40dw4rjayGlPWC5m/jNhn9/ZuzBEzmjhaR7T7g+SGNCBWu9
yPZmuU4bnszBQKMPQ8w+2rHD0SBTXAzNzjzoOqcv6XiI5Vu4nWICY37vUjpVvKMt
WhgNzJFfSS3OAsHclEOKBRa5BKWtXijwjcIssthmpxDVkhKBmSn89HZJPhvL6GZE
KmrNsk/iOTABsqeZ+1e9ev26/OealQWqm9ue5TVSvnGU/RdeIUG+s2bJNYIH9kvZ
dsSAAQtNHnbrGKoS1KBuGrzzgoL0Mth4qkV//TNPlzCzzlLRDAdkJClQ3q9mYUk/
Tntb64L57FMCfHKLYULkp+IZ+WoxE/Zpv0zO4fq367M5nv/Y+xUldJuYSpMMW5z0
dbGnzvy/43h2e314yM7TTHM6qOfyPJVFvR6uwGbszWucThOMbPD23Iq3K9Jdi6Ug
gi4yMxB+ly5dcLuvZSdiz9Ry10Ljo62zRWBIEnHoAI5WI90vpHq9YW8kmXRYbEJc
wZlIVPLyAtZmF5q3XfRs
=2uLa
-----END PGP SIGNATURE-----

--=-yMWJ+M7XABLVfcLwL4++--

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]