Subject: RE: SSL Handshake time out

From: [email-masked]
Date: Tue, 9 Mar 2004 15:03:02 -0000

-----Original Message-----
From: Joe Pearson [mailto:[email-masked]]
Sent: Tuesday, 09 March 2004 14:39
To: [email-masked]
Subject: SSL Handshake time out

Hello, 

I have a server that has been reaching max clients serveral times per day.
When I look at apache-status, 90% of the children are in "Reading Request"
state.  Most of them stay in that state until the apache "Timeout" is
reached. However, some of the children stay reading until I restart http.
Since this causes my server to become unresponsive, I've lowered the Timeout
to 200, which helps somewhat, but we still have the problem. 
> [snip]

What's your SSLSeesionCache set to? I can't remember the 7.2 settings (It'll
be in the archives though as I've posted the right one before). The Red Hat
9 setting is:

SSLSessionCache         dbm:/var/cache/mod_ssl/scache

Of course, 7.2 isn't supported by Red Hat any more, but there is a "legacy"
project to keep patches up to date.

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Why do so many people who call themselves christians use the name of Jesus
Christ as a swear word?

- 
DISCLAIMER: 

NOTICE: The information contained in this email and any attachments is 
confidential and may be privileged. If you are not the intended 
recipient you should not use, disclose, distribute or copy any of the 
content of it or of any attachment; you are requested to notify the 
sender immediately of your receipt of the email and then to delete it 
and any attachments from your system. 

RNIB endeavours to ensure that emails and any attachments generated by 
its staff are free from viruses or other contaminants. However, it 
cannot accept any responsibility for any  such which are transmitted.
We therefore recommend you scan all attachments. 

Please note that the statements and views expressed in this email and 
any attachments are those of the author and do not necessarily represent 
those of RNIB. 

RNIB Registered Charity Number: 226227 

Website: http://www.rnib.org.uk 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Joe Pearson <[email-masked]>
Date: Tue, 09 Mar 2004 09:33:20 -0700

SSLSessionCache shm:/var/cache/ssl_gcache_data(524288) 
I'm not sure why it is set to that, but it is.  I have a different 
system that does not have this problem and it's session cache is set thus:

SSLSessionCache         shm:logs/ssl_scache(512000)  

I've also noticed that children that don't get reset when the timeout is 
reached, usually end with this:
[09/Mar/2004 08:58:31 18268] [error] SSL handshake timed out (client 
164.165.89.
10, server www3.homecu.net:443)
[09/Mar/2004 09:02:23 18268] [error] SSL handshake interrupted by system 
[Hint:
Stop button pressed in browser?!] (System error follows)
[09/Mar/2004 09:02:23 18268] [error] System: Connection reset by peer 
(errno: 104)

We are subscribed to progeny for Redhat 7.x patches.  We tried RHEL and 
we had so many problems that we
had to revert back to 7.x until we decide what direction to go.