Subject: Re: No solution for bug with IE on Mac?

From: "Nisbach, Thomas" <[email-masked]>
Date: Thu, 28 Mar 2002 18:45:18 +0100

Hi,

i found one (unsatisfying) solution:
I disabled SSLv3 by setting

SSLProtocol -SSLv3

If i do this MSIE on Mac runs but i worry about
other browser that would not run anymore :-(

Try also what's posted in
http://www.mail-archive.com/[email-masked]/msg13577.html

Thomas
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: James Hastings-Trew <[email-masked]>
Date: Thu, 28 Mar 2002 11:56:08 -0600

> http://www.mail-archive.com/[email-masked]/msg13577.html

Basically, the only thing that fixed it on my server was to establish a
sessioncache. I've been using IE on a Mac with our secure pages for months
now.

---

From: Robert Allerstorfer <[email-masked]>
Date: Fri, 29 Mar 2002 17:51:10 +0100

Hi James,

On Thu, 28 Mar 2002, 11:56 GMT-06 (18:56 local time) James

> sessioncache. I've been using IE on a Mac with our secure pages for months

that sounds interesting. So can we be sutre that the problem has
nothing to do with the nokeepalive environment variable that IE4 seems
to need and also nothing with SSLCipherSuite? Could you please explain
how to "establish a sessioncache"?

Thanks,
rob.

--
Robert Allerstorfer <[email-masked]>
ANET - New Media Solutions
Allerstorfer & Beutel OEG
A-1070 Wien, Apollogasse 9/7
Fon: (+43 1) 929133-1
Fax: (+43 1) 929133-2
http://www.anet.at   [email-masked]
PGP Public key: http://www.anet.at/[email-masked]

---

From: Robert Allerstorfer <[email-masked]>
Date: Sun, 31 Mar 2002 14:11:58 +0200

Finally, I have now been able to find the solution required to make
mod_ssl work with IE5 on the Mac. As suggested by James Hastings-Trew,
establishing a global sessioncache did it. In detail, one should add
a line like the following near the top of the <IfDefine HAVE_SSL>
section:

SSLSessionCache dbm:/var/log/apache/ssl_session_cache

The default timeout of 300 s works well. In addition, the following
directive recommended in the mod_ssl FAQ to support old 56bit export
versions of MSIE 5.x would also be a good idea, but is not required
for the current IE5 on the Mac:

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

Unlike recommended in the mod_ssl FAQ, these environment variables are
*not* needed by any IE5 tested so far: nokeepalive, downgrade-1.0 and
force-response-1.0 so it should be better to only set them in versions
smaller than 5:

SetEnvIf User-Agent "MSIE [1-4]\." nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
SetEnvIf User-Agent "MSIE [5-9]\." ssl-unclean-shutdown

I'm hapy to have found this easter egg :-)