Subject: Re: Webpage over SSL timing out?

From: "Sarah Haff" <[email-masked]>
Date: Tue, 07 Oct 2003 16:00:11 -0700

>This is actually most likely a problem with either SSL session caching or
>with "keepalive" HTTP requests.  What settings are you using for the
>SSLSessionCache directive?  Does this only happen with Internet Explorer?
>If so, are you using the SetEnvIf directive suggested at
>http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#msie ?

Cliff,

Thanks for the response. The problems happens with Mozilla and IE.

Here is my SSLCache setting in ssl.conf
SSLSessionCache        shmcb:logs/ssl_scache(512000)
#SSLSessionCache         dbm:logs/ssl_scache
SSLSessionCacheTimeout  1300

and httpd.conf
#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

Thanks.
Sarah.

_________________________________________________________________
Instant message in style with MSN Messenger 6.0. Download it now FREE!  
http://msnmessenger-download.com

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Wed, 8 Oct 2003 01:12:25 +0200

> SSLSessionCacheTimeout  1300
Looks ok - you could try confirming that session caching works by
using the command: 

openssl s_client -connect HOST:PORT -reconnect

> # one request per connection). Set to "Off" to deactivate.
This might be diabled elsewhere by something like (from the std config):

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
	 downgrade-1.0 force-response-1.0
		  
You could try without it and see if it helps.

vh

Mads Toftum
-- 
Speaking at ApacheCon 2003 - http://ApacheCon.com/
T03, "Apache 2 mod_ssl tutorial" (3h)
WE03, "Troubleshooting Apache configurations" 
WE11, "Apache mod_rewrite, the Swiss Army Knife of URL manipulation" 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Jason Haar <[email-masked]>
Date: Wed, 8 Oct 2003 15:39:31 +1300

Bit of a "me too" here. Just today I noticed an issue whereby running a PHP
web page that does LDAP queries across our WAN was hanging forever (not an
SSL issue BTW - bad LDAP server). I hit the "Stop" button and tried
reloading to have another go - and the browser's "swirly thing" swirled away
forever - after ten minutes it was still going. A sniffer shows HTTPS
traffic between my workstation and the server - but the server never
attempted the second LDAP call - which makes me think the request never
happened (i.e. something got stuck in SSL land)

In the end the only fix was to either kill the browser, or restart the httpd
server.

That was Mozilla 1.5 under Redhat 8 talking to Apache 1.3.27/mod_ssl-2.8.12-2

Timeout 300
KeepAliveTimeout 15
SSLSessionCache         dbm:logs/ssl_scache
SSLSessionCacheTimeout  300

> openssl s_client -connect HOST:PORT -reconnect

That appears to work fine here too - I get the "reused" line...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]