Subject: RE: Connection re-negotiation

From: "MATHIHALLI,MADHUSUDAN (HP-Cupertino,ex1)" <[email-masked]>
Date: Mon, 14 Jan 2002 10:04:57 -0800

Hi,
	Thanks for all the feedbacks.. We did confirm that IE 6.0 has a bug
and it can't upgrade a 56-bit connection to a 128-bit one.. The Netscape
browser doesn't have the problem :-)..

Thanks
-Madhu

-----Original Message-----
From: Simon Ritchie [mailto:[email-masked]]
Sent: Monday, January 14, 2002 4:05 AM
To: [email-masked]
Subject: RE: Connection re-negotiation

I hit a more fundamental problem with IE.  According to me, it doesn't
support the keepalive messages that are needed to keep an SSL connection
open, so the connection dies when the keepalive timeout kicks in - by
default after one minute.  This means that unless you request a new page
every minute, the connection dies and your browser has to renegotiate the
whole thing from scratch.  If the server mandates a 128-bit connection for
the next page, then the problem that you are asking about goes away.
However, the cost of negotiating a new connection on every request is high.

In the default configuration, Apache sets keepalive off if the browser is
IE, but it appears that this just forces renegotiation on every request.

Can anybody confirm that all this is correct?  If so, is there a way to get
around it (other than using another browser)?

Simon

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of MATHIHALLI,MADHUSUDAN
> (HP-Cupertino,ex1)
> Sent: 08 January 2002 01:11
> To: [email-masked]'
> Subject: Connection re-negotiation
>
>
> Hi mod_ssl gurus,
> 	I had a small question regarding connection re-negotiation :
>
> The scenario is that I have a 56-bit browser (IE 6.0) and a 128/168 bit
> enabled apache (+mod_ssl 2.8.4) server.. During a https transaction, the
> browser
> establishes 56-bit connection, but then inorder to access a particular
> location, a 128 bit connection is mandated by the server (using the
> SSLRequire option).. Is it possible that the client can upgrade the
> connection to a 128-bit one ??.. If yes, how to achieve that ?..
>
> -Madhu
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
>

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]