Subject: No solution for bug with IE on Mac?

From: Robert Allerstorfer <[email-masked]>
Date: Wed, 27 Mar 2002 02:16:20 +0100

Hi,

I have searched the archive and it seems that there is still no
solution on how to make a https page viewable with MSIE on MacOS.
It has been reported at
http://www.mail-archive.com/[email-masked]/msg13314.html
a month ago and even back in 2000 at
http://www.mail-archive.com/[email-masked]/msg08560.html

This annoying popup window stating
"Security failure: Data decryption error" also comes with the latest
Apache SSL environment (Apache/1.3.23 + mod_ssl/2.8.7 +
OpenSSL/0.9.6c) on the latest Mac (OS 10.1) using the latest IE
(5.1.3). You can see it yourself here: https://secure.anet.at/

Any help would be greatly appreciated.

Kind regards,
rob.

--
Robert Allerstorfer <[email-masked]>
ANET - New Media Solutions
Allerstorfer & Beutel OEG
A-1070 Wien, Apollogasse 9/7
Fon: (+43 1) 929133-1
Fax: (+43 1) 929133-2
http://www.anet.at   [email-masked]
PGP Public key: http://www.anet.at/[email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: John Siracusa <[email-masked]>
Date: Wed, 27 Mar 2002 08:56:50 -0500

> solution on how to make a https page viewable with MSIE on MacOS.

Actually, I think there is (finally!) a solution.  The following works for
me (thanks to Mark J. Lilback).  I thought I posted it here earlier, but if
not, I'm sorry! :)

---

Subject: Re: mod_ssl and Mac IE5
Date: Wednesday, February 6, 2002 2:33 PM
From: Mark J. Lilback <[email-masked]>

>On 2/6/02 1:25 PM, Mark J. Lilback wrote:
>>  Hi... I saw an old message you'd posted to the modssl-users list
>>  about IE problems. Did you ever resolve this?
>
>No, and it still drives me nuts to this day... :-/

I just solved it. Do not use an SSLProtocol line. Comment out the
SetEnvIf line that does nokeepalive for MSIE. Use the following
instead.

BrowserMatch "MSIE [1-4]" nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [5-9]" ssl-unclean-shutdown

I'm also using this cipher suite line, but the default might work, too:

SSLCipherSuite 
!EXP1024-RC4-SHA:!EXP1024-DES-CBC-SHA:ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:
+LOW:+SSLv2:+EXP:+eNULL

This took way too long to figure out, but at least it works now.

Please post this to any list/newsgroup you find appropriate, as I
don't have usenet access (and I saw a ton of questions about this on
the mac ie newsgroup) and ended up having to piece together numerous
pieces of the solution from numerous other posts.

---

-John

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 27 Mar 2002 15:50:50 -0500 (EST)

> !EXP1024-RC4-SHA:!EXP1024-DES-CBC-SHA:ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:

That !EXP56 should be !EXPORT56 .

And by the way, the mod_ssl FAQ recommends this:

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

which is pretty similar to what you have but slightly less restrictive.

--Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Apache HTTP Server Project

---

From: "Jeremy Walton" <[email-masked]>
Date: Wed, 27 Mar 2002 16:45:49 -0500

I think this just may be a bug with IE but I'm not sure.  When I use CGI
scripting with the default install of (Caldera OpenLinux 3.1 or 3.11,
Not sure of the mod_ssl version and if someone can tell me how to find
out I'll post it too).  I found the problem with XP(IE 6) but for W98
and W2k (IE6 or IE5), every now and then I get a page cannot be
displayed error,  but If I took mod_ssl off and used standard http, it
worked fine.  Now I did find a fix for this but I wanted some info from
the group on this.

I put a

SSLProtocol -all +SSLv2

This allowed me to only use the SSL version 2 protocol.  This worked
perfectly.  Anyone on any guess for this?

Jeremy Walton
DICE Corporation
Software Engineer

---

From: Robert Allerstorfer <[email-masked]>
Date: Fri, 29 Mar 2002 17:02:16 +0100

Hi John,

On Wed, 27 Mar 2002, 08:56 GMT-05 (14:56 local time) John Siracusa

> !EXP1024-RC4-SHA:!EXP1024-DES-CBC-SHA:ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:

thanks for this suggesion but, unfortunately, removing those additional
environment variables for IE 5+ could not solve the problem. Also, the
new SSLCipherSuite didn't make a difference. I now use the default
value for the SSLCipherSuite directive. But, Mac users still cannot
connect properly with their IE. I am now not sure if this will be ever
possible - probably, Microsoft should state something about their
problem.

best,
rob.