Subject: RE: SSL cache issue

From: Shiraz Esat <[email-masked]>
Date: Wed, 3 Apr 2002 10:50:19 +0100

Jeremy et al,

Server-side: Linux, Apache 1.3.20, mod_ssl 2.8.4, OpenSSL 0.9.6b, PHP 
4.1.2.
Client-side: Win2000, IE5.5.
Surely this is a server-side problem? Or, at least, surely there must be a 
'fix' server-side? After all, do we need to tell all site-visitors to fix 
their browsers?

Thanks in advance,
Shiraz

-----Original Message-----
From:	Jeremy Walton [SMTP:[email-masked]]
Sent:	Tuesday, April 02, 2002 10:00 PM
To:	[email-masked]
Subject:	RE: SSL cache issue

Actually I've had this problem.  I may have the solution for you if you
can tell me what OS your running the client from and what browser.

Jeremy Walton
DICE Corporation

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Shiraz Esat
Sent: Tuesday, April 02, 2002 4:10 AM
To: [email-masked]'
Subject: RE: SSL cache issue

Terry,

If anyone passes you a solution, can you please pass it on to me as
well, as I have the same problem :(

[Only difference, though, is that I'm using PHP generated pages]

Thanks in advance
Shiraz

-----Original Message-----
From:	Terry Ziemniak [SMTP:[email-masked]]
Sent:	Friday, March 29, 2002 9:31 PM
To:	[email-masked]'
Subject:	SSL cache issue

I am getting 'page not found errors' the first time I access certain JSP
pages (though there are others that always work).  If I refresh the page
displays correctly.

Notes:
1.	This only happens over HTTPS, never over HTTP
2.	Netscape (v 4.2) displayed the error "Data Missing.  This
document
resulted from a POST operation and has expired from the cache.  If you
wish you can repost the form data to create the document by pressing the
reload button."
3.	Apache's access.log seems to validate point 2.  The last line
before
an error is a POST.  The retry shows a POST followed shortly by anther
GET and POST of the same JSP.
4.	I have not yet been able to exactly describe 'First time'.
General
rule of them, if I repeat the process within 15 minutes it seems OK.  If
I wait an hour it should fail.  Though quantifying that has not been my
highest priority.
5.	I am running Apache_1.3.20-Mod_SSL_2.8.4-OpenSSL_0.9.6a-WIN32
and
Resin 1.2.8.

Any help would be appreciated.

Terry Ziemniak

 << File: ATT00002.htm >>
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Jeremy Walton" <[email-masked]>
Date: Wed, 3 Apr 2002 13:07:07 -0500

Yes I've had this problem.  One make sure a generate your OWN
certificate and not one that comes with OpenSSL or distributions and add
this to your SSL VirtualHost

SSLProtocol -all +SSLv2

This should get rid of this problem.  As I'm guessing that you have have
had the same problem I have.  This seemed to have fixed the problem.  I
think there is a problem with IE and OpenSSL using SSLv3 with an
uncertified SSL certificate.  Let me know if this has fixed your
problem.

Jeremy Walton
DICE Corporation

-----Original Message-----
Sent: Wednesday, April 03, 2002 4:50 AM

Jeremy et al,

Server-side: Linux, Apache 1.3.20, mod_ssl 2.8.4, OpenSSL 0.9.6b, PHP 
4.1.2.
Client-side: Win2000, IE5.5.
Surely this is a server-side problem? Or, at least, surely there must be
a 
'fix' server-side? After all, do we need to tell all site-visitors to
fix 
their browsers?

Thanks in advance,
Shiraz

-----Original Message-----
From:	Jeremy Walton [SMTP:[email-masked]]
Sent:	Tuesday, April 02, 2002 10:00 PM
To:	[email-masked]
Subject:	RE: SSL cache issue

Jeremy Walton
DICE Corporation

-----Original Message-----

Terry,

Thanks in advance
Shiraz

-----Original Message-----
From:	Terry Ziemniak [SMTP:[email-masked]]
Sent:	Friday, March 29, 2002 9:31 PM
To:	[email-masked]'
Subject:	SSL cache issue

Notes:

Terry Ziemniak

 << File: ATT00002.htm >>