Subject: Re: SSL-Problem with Mac MSIE

From: "Nisbach, Thomas" <[email-masked]>
Date: Tue, 23 Apr 2002 18:38:22 +0200

Hi David,

there was a discussion in the mod_ssl-group a few weeks
ago. Some solutions/workarounds were discussed.
Robert Allerstorfer ment he found "THE" solution. Last
week one of our clients tried to access our "fixed"
SSL-server via Mac MSIE 5.13 and still had a problem.
The only thing working thing working at our site was
disabling SSLv3.
Additionally here's an extract of one of my contributions
to the mod_ssl-discussion:
Hi,

i found one (unsatisfying) solution:
I disabled SSLv3 by setting

SSLProtocol -SSLv3

If i do this MSIE on Mac runs but i worry about
other browser that would not run anymore :-(

Try also what's posted in
http://www.mail-archive.com/[email-masked]/msg13577.html
<<<
-----Ursprüngliche Nachricht-----
Von: David McInnis [mailto:[email-masked]]
Gesendet: Dienstag, 23. April 2002 06:01
An: [email-masked]
Betreff: SSL-Problem with Mac MSIE

Did you ever come up with a fix for this?  I am having the same problem.

Thanks,

David McInnis
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Thomas Binder <[email-masked]>
Date: Tue, 23 Apr 2002 20:01:37 +0200

Hi!

> other browser that would not run anymore :-(

Btw, as for my understanding this does not disable TLSv1: Does
IE's TLS1-support work any better than its SSL3 implementation?

And what also bothers me: Why do these problems only seem to
affect OpenSSL based webservers, and not for example iPlanet? Do
these non-affected servers contain other/better workarounds? Or do
they only support SSL2?

Is it really such a serious drawback to disable SSL3? Most current
browsers (e.g. links, Mozilla, Opera) seem to support and default
to TLS1, anyway.

Ciao

Thomas

---

From: "Peter Viertel" <[email-masked]>
Date: Wed, 24 Apr 2002 00:37:08 +0100

No I wouldnt want to disable SSL3 either...

One case I know of like this is to do with advertising EXPORT56 ciphers 
on the server side... some variants of IE barf if they're talking to a 
site with a so called 128 bit certificate (an SGC cert).

I have used this when a site has an uber-cert for marketing reasons, and 
the crypto requirement is not high:

SSLCipherSuite 
!EXPORT56:ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

the broken clients end up using SSL3 with 40bit keylength, good clients 
talk SSL3/128bit or TLS, it still gives the option for SSL2 and allows 
null encryption too.