Subject: Problem with reading client certificate - downgrade doens't seem to work

From: Bruno Georges <[email-masked]>
Date: Mon, 11 Mar 2002 16:45:29 +0000

Hi

Some of our users have the following problem:
 when users are submiting their order[https and POST], the app send the 
confirmation page but nothing is displayed on the user's browser.

First  here is our stting:
OS: Solaris 2.7
Web Sever: Apache 1.3.23 + mod_ssl-2.8.7-1.3.23 + openssl-0.9.6c
App server: NewAtlanta ServletExec 4.1

apache vhost config:
------------------------
...
SSLCipherSuite 
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown  
downgrade-1.0 force-response-1.0
...

Our logs show for 2 of the failing requests [I replaced IPs with 
Browser1 and Browser2]:

SSL LOG:
------------
[11/Mar/2002:11:21:51 +0000] Browser1 TLSv1 RC4-MD5 "GET /main HTTP/1.1" 
14514
[11/Mar/2002:15:26:29 +0000] Browser2 SSLv3 RC4-MD5 "POST /main 
HTTP/1.1" 23618

Apache Logs shows the folowing User Agents:
------------------------------------------------------
Browser1: Mozilla/4.0 (compatible;MSIE 6.0; AOL 7.0; Windows 98)
Browser2: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)

app server logs show:
-------------------------
[Mon Mar 11 11:20:32 GMT 2002] Unknown certificate data:
[Mon Mar 11 11:20:32 GMT 2002] ClientCert: oop init: 
java.util.NoSuchElementException
[Mon Mar 11 11:20:32 GMT 2002] java.util.NoSuchElementException
[Mon Mar 11 11:20:32 GMT 2002]  at 
java.util.StringTokenizer.nextToken(StringTokenizer.java:235)
[Mon Mar 11 11:20:32 GMT 2002]  at 
com.newatlanta.servletexec.ClientCert.parseCert(ClientCert.java:204)
....
Retrieving the client certificate data
[Mon Mar 11 15:26:28 GMT 2002] java.net.SocketException: Connection 
reset by peer: Connection reset by peer
[Mon Mar 11 15:26:28 GMT 2002]  at 
java.net.SocketInputStream.socketRead(Native Method)
[Mon Mar 11 15:26:28 GMT 2002]  at 
java.net.SocketInputStream.read(SocketInputStream.java:90)

It looks like it is not possible to get anything from the client, and 
the connection is broken.
I am a bit confused, according to the SetEnvIf directive IE response 
should be HTTP/1.0, also we force the form method to POST, which has no 
effect.

Thanks for any help.

Bruno Georges

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: jon schatz <[email-masked]>
Date: 11 Mar 2002 11:31:10 -0800

> should be HTTP/1.0, also we force the form method to POST, which has no 

I had this problem w/ 1.3.20 + 1.3.22 + the appropriate mod_ssl +
mod_perl-1.2.26 on linux systems. It "magically" fixed itself with the
release of apache-1.3.23 + mod_ssl-2.8.6. Try this and see what happens
(to see if your setenvif is working):

[jon@devotchka jon]$ openssl s_client -quiet -connect devotchka:23456
<<EOF
> GET / HTTP/1.1
> Host: devotchka
> User-Agent: Mozilla/4.0 Compatible (MSIE)
> 
> EOF

Inside of my reply, I get (among other things):

> HTTP/1.0 200 OK
> Date: Mon, 11 Mar 2002 19:27:28 GMT
> Server: Apache/1.3.23 (Unix) mod_ssl/2.8.6 OpenSSL/0.9.6b
> mod_perl/1.26

I haven't upgraded to 2.8.7 yet, so i wonder if this problem was
reintroduced....

-jon

-- 
[email-masked] || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus?: www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."