Subject: SSL Problem

From: "Kim L. Christensen" <[email-masked]>
Date: Thu, 21 Feb 2002 11:36:24 +0100

Hi, 

I hope that someone can provide me with some help reg. a strange problem I 
have when setting up SSL with Apache.
I have virtual domains installed and one IP address to the Internet - all 
that is working fine.
I have now set up 1 virtual domain with SSL with the same virtual domain 
name I had already for one of the domains, and created myself a certificate 
following the FAQ. 

When I try to access https://domain_name I get a time out after a while.
When I access https://internal_IP_address the server responds immediately. 

If I do: curl https://localhost/
the result is:
curl: (35) SSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown 
protocol

If I do: openssl s_client -connect localhost:443 -state -debug
the result is:
CONNECTED(00000003)
SSL_connect:before/connect initialization
write to 08153F18 [08153F60] (124 bytes => 124 (0x7C))
0000 - 80 7a 01 03 01 00 51 00-00 00 20 00 00 16 00 00   .z....Q... .....
0010 - 13 00 00 0a 07 00 c0 00-00 66 00 00 05 00 00 04   .........f......
0020 - 03 00 80 01 00 80 08 00-80 00 00 65 00 00 64 00   ...........e..d.
0030 - 00 63 00 00 62 00 00 61-00 00 60 00 00 15 00 00   .c..b..a..`.....
0040 - 12 00 00 09 06 00 40 00-00 14 00 00 11 00 00 08   ......@.........
0050 - 00 00 06 00 00 03 04 00-80 02 00 80 51 02 7e 73   ............Q.~s
0060 - a2 cd 80 06 26 ec 4b 78-db 58 4e 40 d5 c2 d9 a4   ....&.Kx.XN@....
0070 - d8 81 e7 9e 30 e0 1d 60-cb 1e 18 70               ....0..`...p
SSL_connect:SSLv2/v3 write client hello A
read from 08153F18 [081594C0] (7 bytes => 7 (0x7))
0000 - 3c 21 44 4f 43 54 59                              <!DOCTY
SSL_connect:error in SSLv2/v3 read server hello A
9267:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown 
protocol:s23_clnt.c:460: 

Please help :-) 

Regards
Kim Christensen 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Thu, 21 Feb 2002 12:21:13 +0100

On Thu, Feb 21, 2002 at 11:36:24AM +0100, Kim L. Christensen wrote:
[SNIP]
> 0000 - 3c 21 44 4f 43 54 59                              <!DOCTY
                                                           ^^^^^^^
The server that you're trying to connect to is running plain HTTP -
otherwise you would not be seeing the <!DOCTY as part of the SSL
protocol negotiation.

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Kim L. Christensen" <[email-masked]>
Date: Thu, 21 Feb 2002 13:02:17 +0100

Thanks for the response, but how can I solve the problem.
I am starting Apache with SSL and Apache accept my passphrase. 

Regards
Kim 

> otherwise you would not be seeing the <!DOCTY as part of the SSL

Kim Christensen
Hambros Alle 15
2900 Hellerup - DK
(45) 2041 4156
http://www.hambrosalle.dk                    http://www.web-counting.com

---

From: Mads Toftum <[email-masked]>
Date: Thu, 21 Feb 2002 13:29:42 +0100

> I am starting Apache with SSL and Apache accept my passphrase. 
Check your error logs, make sure that you have SSLEngine on and increase
the SSLLogLevel to debug.

vh

Mads Toftum

---

From: "Kim L. Christensen" <[email-masked]>
Date: Thu, 21 Feb 2002 14:22:39 +0100

Now it's getting funny. Someone tried to log on from outside and that worked 
out fine.
But logging on from intranet or the server itself does not work ??? 

Kim 

Kim Christensen
Hambros Alle 15
2900 Hellerup - DK
(45) 2041 4156

---

From: Mads Toftum <[email-masked]>
Date: Thu, 21 Feb 2002 15:36:50 +0100

On Thu, Feb 21, 2002 at 02:22:39PM +0100, Kim L. Christensen wrote:
> Now it's getting funny. Someone tried to log on from outside and that 
> worked out fine.

Without looking at your configuration, it is a bit difficult to guess
exactly what is going on - but you probably have apache set up to
bind to the external interface ... try something like:

netstat -an|grep 443

vh

Mads Toftum

---

From: "Kim L. Christensen" <[email-masked]>
Date: Thu, 21 Feb 2002 16:46:23 +0100

Mads, I get the followin results to your suggestion: 

To port 80: (looks ok)
antibes:~ # netstat -an|grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
unix  2      [ ACC ]     STREAM     LISTENING     12809  
/home/perth/interchange/etc/socket.ipc
unix  3      [ ]         STREAM     CONNECTED     239480 

To port 443: (When I am trying to connect)
antibes:~ # netstat -an|grep 443
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN
tcp        0      1 192.168.1.2:33039       193.89.241.44:443       SYN_SENT 

Kim Christensen
Hambros Alle 15
2900 Hellerup - DK
(45) 2041 4156