Subject: Connection re-negotiation

From: "MATHIHALLI,MADHUSUDAN (HP-Cupertino,ex1)" <[email-masked]>
Date: Mon, 7 Jan 2002 20:10:37 -0500

Hi mod_ssl gurus,
	I had a small question regarding connection re-negotiation :

The scenario is that I have a 56-bit browser (IE 6.0) and a 128/168 bit
enabled apache (+mod_ssl 2.8.4) server.. During a https transaction, the
browser
establishes 56-bit connection, but then inorder to access a particular
location, a 128 bit connection is mandated by the server (using the
SSLRequire option).. Is it possible that the client can upgrade the
connection to a 128-bit one ??.. If yes, how to achieve that ?..

-Madhu
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Lutz Jaenicke <[email-masked]>
Date: Tue, 8 Jan 2002 12:02:24 +0100

> connection to a 128-bit one ??.. If yes, how to achieve that ?..

If your browser only supports export ciphers, there is nothing the
server can do with respect to a particular location.
However: if you can get hold of a special certificate, you can enable
full strength encryption with a special certificate (search for
"server gated cryptography").
BTW: for netscape new versions are all shipped with full strength
encryption. Isn't the same available for IE?

Best regards,
	Lutz
-- 
Lutz Jaenicke                             [email-masked]
BTU Cottbus               http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik                  Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus              Fax. +49 355 69-4153
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Dr. Peter Kanyion" <[email-masked]>
Date: Tue, 8 Jan 2002 12:15:47 +0100

Hi,

I need to put up a CA Server on Win2000 for testing purposes. Any
recommendation for software will be highly appreciated.

Sorry, if this request is out of scope.

Thanks.
Peter

---

From: "madhon" <[email-masked]>
Date: Tue, 8 Jan 2002 11:40:25 -0000

if you have win2000 server/advanced server you can install certificate
servers to do it

----- Original Message -----
From: "Dr. Peter Kanyion" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, January 08, 2002 11:15 AM
Subject: CA-Server on Win200

Hi,

Thanks.
Peter

---

From: "Dr. Peter Kanyion" <[email-masked]>
Date: Tue, 8 Jan 2002 12:44:50 +0100

Thanks for the swift response. No,I don't have the advanced server version
of Win2000. If I correctly understood your comments, the certificate server
is included in the advanced server, right? If that is the case, I'll strive
to get the Win2000 advanced server version.

Thanks.
Peter

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of madhon
Sent: Dienstag, 8. Januar 2002 12:40
To: [email-masked]
Subject: Re: CA-Server on Win200

----- Original Message -----
From: "Dr. Peter Kanyion" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, January 08, 2002 11:15 AM
Subject: CA-Server on Win200

Hi,

Thanks.
Peter

---

From: "madhon" <[email-masked]>
Date: Tue, 8 Jan 2002 12:19:58 -0000

its included in both the server and advanced server versions of win200
----- Original Message ----- 
From: "Dr. Peter Kanyion" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, January 08, 2002 11:44 AM
Subject: RE: CA-Server on Win200

Thanks.
Peter

----- Original Message -----
From: "Dr. Peter Kanyion" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, January 08, 2002 11:15 AM
Subject: CA-Server on Win200

Hi,

Thanks.
Peter

---

From: "Simon Ritchie" <[email-masked]>
Date: Mon, 14 Jan 2002 12:05:18 -0000

I hit a more fundamental problem with IE.  According to me, it doesn't
support the keepalive messages that are needed to keep an SSL connection
open, so the connection dies when the keepalive timeout kicks in - by
default after one minute.  This means that unless you request a new page
every minute, the connection dies and your browser has to renegotiate the
whole thing from scratch.  If the server mandates a 128-bit connection for
the next page, then the problem that you are asking about goes away.
However, the cost of negotiating a new connection on every request is high.

In the default configuration, Apache sets keepalive off if the browser is
IE, but it appears that this just forces renegotiation on every request.

Can anybody confirm that all this is correct?  If so, is there a way to get
around it (other than using another browser)?

Simon

> [mailto:[email-masked]]On Behalf Of MATHIHALLI,MADHUSUDAN
> (HP-Cupertino,ex1)
> Sent: 08 January 2002 01:11
> To: [email-masked]'
> Subject: Connection re-negotiation
>
>
> Hi mod_ssl gurus,