Subject: RE: Problems with Apache / mod_ssl and Internet Explorer 5/6

From: "Kuczborski, Carol L" <[email-masked]>
Date: Fri, 11 Jan 2002 14:30:32 -0500

I had this problem and spent many, many hours researching.  In my research,
I came across many others with the same problem.  So you are not the only
one.  I received the "Page cannot be displayed" error along with "Cannot
find server or DNS error".  I tried the fix suggested in the Apache mod_ssl
FAQ (change to http.conf file to downgrade to http 1.0).  It did not work.
It looks like you also tried the fix, too. I filed a bug report in the Bug
Database for Apache mod_ssl and never received any response in over 5
months.  I eventually worked with Oracle Worldwide Support because I was
using the Apache Web Server and mod_ssl as packaged with the Oracle9i
Application Server.  I had to work up through the ranks to get the problem
addressed.  Eventually, I implemented two changes that seemed to reduce the
error with much, much less frequency.  I still get the error, but not very
often.

It looks like you have also tried one of the solutions I implemented (change
to http.conf file removing 'nokeepalive').  The other fix I implemented,
Oracle actually had to patch a DLL file of theirs that I believe works with
the mod_ssl component.  Anyways, I saw the code fix they implemented and it
has something to do with retrying the read from the port when it fails to
read the data (they enclosed the read in a "retry" loop until successful).
I don't know if this information will help.  But, I am providing the
details:  

I received this error in two different cases. One case it happened
intermittently on almost any page I tried to access from our website using
SSL and the IE browser. I reduced the errors, quite significantly, but not
entirely, by making the following change in the Apache http.conf file:

From: #SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

To: SetEnvIf User-Agent ".*MSIE.*" ssl-unclean-shutdown

In the other case, I always received the error when I tried to use Oracle
Portal's Add-Item-Wizard pages to upload a document to Oracle Portal's
Content Area. Here was the resolution for that case:

Implemented solution for Oracle Bug No. 1821195 (When uploading large file
using modplsql & SSL error reading data from client) by replacing the
existing ApacheModuleSSL.dll file with the patched file referenced in the
bug details. According to the details for the ApacheModuleSSL.dll patch,
there was mention of a bug in the "select" function in Windows NT 4.0:

"When checking a socket, if data can be read without blocking, select ()
returns yes, but when actually reading from the socket with recv(), that
function returns WSAEWOULDBLOCK, which says that reading would block. It
seems that this problem does not occur in usual operation, but only in an
SSL enabled Apache (modssl or apache-ssl) with https. The code for WIN32,
which handles writing to a socket, already contains a workaround for this.
The code for reading from a socket did not have a workaround." 

Carol Kuczborski 
EDS - Enabling Business Solutions 
MS A6N-B47 
13600 EDS Drive 
Herndon, VA 20171 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, January 11, 2002 2:01 PM
To: [email-masked]
Subject: Problems with Apache / mod_ssl and Internet Explorer 5/6

Hi everyone,
 
I´ve got a big problem:
I installed on SuSE Linux 7.3 the Apache Web Server including
the mod_ssl in order to run a secured webinterface for my
IMAP-Server...
Unsecured everything works just fine in every Browser.
After installing the SSL-Plugin I generated a custom certificate and
everything
works fine with Netscape / Konquerer / w3m.
But when I try to connect via https with any version of Microsofts
Internet Explorer I get the message, that the page cannot be
displayed.
I found out that there are many problems with MSIE, and I did all
the fixes. Here are parts of my httpd.conf. Does anyone has an idea?

Apache-Version 1.3.20
mod_ssl Version 2.8.4
openssl Version 0.96b
PHP Version Pear 4.1.0
MySQL Version 3.21
 
[...]
SSLPassPhraseDialog  builtin
SSLSessionCache         dbm:/var/run/ssl_scache
SSLSessionCacheTimeout  300
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
 
<VirtualHost _default_:443>
SSLEngine on
 
#*** here I tried both versions .... no change
#SSLProtocol ALL -SSLv3 
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
 
SSLVerifyClient none
 
<Files ~ "\.(cgi|shtml|phtml|php3|php?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/local/httpd/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
 
#*** here I tried both versions .... no change
#SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [1-4]" nokeepalive ssl-unclean-shutdown downgrade-1.0
force-response-1.0
BrowserMatch "MSIE [5-9]" ssl-unclean-shutdown

---

From: "Dr. Peter Kanyion - Pnetlinks.com" <[email-masked]>
Date: Sun, 13 Jan 2002 13:55:21 +0100

Hi,

I'm currently researching on public key technology and will appreciate any resource pointers that anyone could provide.

Thanks.
Peter
  ----- Original Message ----- 
  From: Kuczborski, Carol L 
  To: [email-masked]' 
  Sent: Friday, January 11, 2002 8:30 PM
  Subject: RE: Problems with Apache / mod_ssl and Internet Explorer 5/6

  I had this problem and spent many, many hours researching.  In my research, I came across many others with the same problem.  So you are not the only one.  I received the "Page cannot be displayed" error along with "Cannot find server or DNS error".  I tried the fix suggested in the Apache mod_ssl FAQ (change to http.conf file to downgrade to http 1.0).  It did not work.  It looks like you also tried the fix, too. I filed a bug report in the Bug Database for Apache mod_ssl and never received any response in over 5 months.  I eventually worked with Oracle Worldwide Support because I was using the Apache Web Server and mod_ssl as packaged with the Oracle9i Application Server.  I had to work up through the ranks to get the problem addressed.  Eventually, I implemented two changes that seemed to reduce the error with much, much less frequency.  I still get the error, but not very often.

  It looks like you have also tried one of the solutions I implemented (change to http.conf file removing 'nokeepalive').  The other fix I implemented, Oracle actually had to patch a DLL file of theirs that I believe works with the mod_ssl component.  Anyways, I saw the code fix they implemented and it has something to do with retrying the read from the port when it fails to read the data (they enclosed the read in a "retry" loop until successful).  I don't know if this information will help.  But, I am providing the details:  

    I received this error in two different cases. One case it happened intermittently on almost any page I tried to access from our website using SSL and the IE browser. I reduced the errors, quite significantly, but not entirely, by making the following change in the Apache http.conf file:

    In the other case, I always received the error when I tried to use Oracle Portal's Add-Item-Wizard pages to upload a document to Oracle Portal's Content Area. Here was the resolution for that case:

    Implemented solution for Oracle Bug No. 1821195 (When uploading large file using modplsql & SSL error reading data from client) by replacing the existing ApacheModuleSSL.dll file with the patched file referenced in the bug details. According to the details for the ApacheModuleSSL.dll patch, there was mention of a bug in the "select" function in Windows NT 4.0:

    "When checking a socket, if data can be read without blocking, select () returns yes, but when actually reading from the socket with recv(), that function returns WSAEWOULDBLOCK, which says that reading would block. It seems that this problem does not occur in usual operation, but only in an SSL enabled Apache (modssl or apache-ssl) with https. The code for WIN32, which handles writing to a socket, already contains a workaround for this. The code for reading from a socket did not have a workaround." 

  Carol Kuczborski 
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]
  Sent: Friday, January 11, 2002 2:01 PM
  To: [email-masked]
  Subject: Problems with Apache / mod_ssl and Internet Explorer 5/6

    Hi everyone,

    I´ve got a big problem:
    After installing the SSL-Plugin I generated a custom certificate and everything

    Apache-Version 1.3.20
    mod_ssl Version 2.8.4
    openssl Version 0.96b
    PHP Version Pear 4.1.0
    MySQL Version 3.21

    [...]

    #*** here I tried both versions .... no change
    #SSLProtocol ALL -SSLv3 
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

    SSLVerifyClient none

    #*** here I tried both versions .... no change
    #SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [1-4]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [5-9]" ssl-unclean-shutdown

---

From: Luciano Miguel Ferreira Rocha <[email-masked]>
Date: Sun, 13 Jan 2002 21:50:21 +0000

There's a lot of information about cryptography in RSA Labs' site:
http://www.rsasecurity.com/rsalabs/

The standards on public key (PKCS) can be found here:
http://www.rsasecurity.com/rsalabs/pkcs/index.html

Regards,
Luciano Rocha
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]