You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2008/04/23 15:26:41 UTC
DO NOT REPLY [Bug 44858] New: Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Summary: Systematic SSL session renegociation, client cert,
Firefox >= 2.0.13
Product: Apache httpd-2
Version: 2.2.8
Platform: PC
OS/Version: Linux
Status: NEW
Severity: major
Priority: P2
Component: mod_ssl
AssignedTo: bugs@httpd.apache.org
ReportedBy: sargastic@yahoo.fr
Not quite sure if it's a bug or one hell of a feature :-)
There are two "zones" on our SSL-ized server :
SSLPassPhraseDialog builtin
SSLSessionCache "shm:/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/apache/logs/ssl_mutex"
<VirtualHost _default_:443>
#
# The regular, simple SSL server
#
DocumentRoot "/apache/htdocs"
ServerName some.thing.org:443
SSLEngine on
SSLCertificateFile "/apache/conf/ssl/server.crt"
SSLCertificateKeyFile "/apache/conf/ssl/server.key"
SSLCACertificateFile "/apache/conf/ssl/ca.crt"
Alias /manual /apache/manual
# And a sub-tree with Client Cert verification
#
<Directory "/apache/manual">
Options Indexes
AllowOverride None
Order allow,deny
Allow from all
SSLRequireSSL
SSLVerifyClient require
SSLVerifyDepth 1
</Directory>
</VirtualHost>
Since Firefox 2.0.13, the default config of the browser regarding client
certificates is "Ask everytime" (that's because of
https://bugzilla.mozilla.org/show_bug.cgi?id=295922).
And that's where we get badly hit. When requesting server:443/manual/something,
we ALWAYS get an SSL renegociation :
[info] Initial (No.1) HTTPS request received for child 2 (server
some.thing.org:443)
[debug] ssl_engine_kernel.c(426): Changed client verification (0 to 3) type
will force renegotiation
[info] Requesting connection re-negotiation
The "(0 to 3)" in the second message means "verify_old is 0 (NONE), verify is 3
(PEER_STRICT)", probably because when URL-parsing we went from / (no client
cert verification) to /manual (SSLVerifyClient Require). That's just a guess.
The end result is that, for every request (except keepalive), the browser asks
"Which client certificate do you want to use ?", making the user-experience
quite hellish.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
--- Comment #6 from juan-manuel.perez@tecsidel.es 2009-06-02 02:53:05 PST ---
Created an attachment (id=23742)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23742)
Logs
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
--- Comment #8 from Mike <mi...@gmail.com> 2009-06-02 06:31:00 PST ---
Did you tried the patch from bug 47055?
I can help.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |DUPLICATE
--- Comment #7 from Joe Orton <jo...@redhat.com> 2009-06-02 03:06:20 PST ---
I think this is the same problem as bug 47055, which has more analysis, so
marking this as a dupe.
*** This bug has been marked as a duplicate of bug 47055 ***
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
juan-manuel.perez@tecsidel.es changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--- Comment #4 from juan-manuel.perez@tecsidel.es 2009-06-02 02:50:45 PST ---
We have exactly this problem. As I see this bug was frozen, we'll reopen it,
providing some more information. I expect it is enough for you to check it.
The problem is not really severe if you use Firefox 2, because when the user is
prompted for a certificate, it has the option to 'Remember this decision'. But
with Firefox3 this option has been removed, and now users are prompted
continuously for a certificate.
We have checked it with the latest available binary distribution
(apache_2.2.8-win32-x86-openssl-0.9.8g.msi).
We provide the logs (with debug level on).
We also provide the used configuration files, a test page, and a certificate to
reproduce the problem, and a document explaining the problem.
We have already tested other configurations, but they either don't work as
expected, or are not valid for our requirements: we need some pages to require
client certificate, and others not to. We are looking for a workaround, but the
one we are thinking of is not very nice...
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
--- Comment #9 from juan-manuel.perez@tecsidel.es 2009-06-22 01:24:13 PST ---
Thank you very much.
This patch solves, indeed, the problem we reported. We have only these
comments:
- It worked properly only after adding the +OptRenegotiate option. Thus, we
finally have this configuration (only relevant piece shown):
SSLVerifyClient none
<Location "/test">
SSLVerifyClient require
SSLVerifyDepth 10
SSLOptions +OptRenegotiate
</Location>
- There is only a little 'misbehaviour' we have found. If, after starting
apache, and firefox 3 (with clean cache), we first access 'https://localhost'
(which doesn't require client cert), and then we access 'https://test/', we are
prompted for the client certificate twice (this is the 'misbehaviour'). From
then onwards, we are not prompted any more (perfect!) Also, if we first access
'https://test/', we are prompted only once (perfect!).
I have only one more question. When is planned this patch to be included in an
official Apache release?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Juan Manuel Perez Delgado <ju...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |juanmpd@gmail.com
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
--- Comment #5 from juan-manuel.perez@tecsidel.es 2009-06-02 02:52:35 PST ---
Created an attachment (id=23741)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23741)
How to test the problem/bug
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Violhaine Grimly <sa...@yahoo.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |sargastic@yahoo.fr
Status|NEEDINFO |ASSIGNED
--- Comment #2 from Violhaine Grimly <sa...@yahoo.fr> 2008-04-23 11:23:46 PST ---
I just tested it, and got exactly the same behavior :
[debug] ssl_engine_kernel.c(426): Changed client verification (0 to 3) type
will force renegotiation
<Directory "/apache/manual">
Options Indexes
AllowOverride None
Order allow,deny
Allow from all
SSLRequireSSL
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +OptRenegotiate
</Directory>
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |NEEDINFO
--- Comment #3 from Joe Orton <jo...@redhat.com> 2008-04-25 03:04:26 PST ---
Can you capture the complete logs for that? The sequence should be:
1. initial request to /manual
=> client cert requested
2. subsequent request to /blah
=> no client cert requested
3. second request to /manual
=> client cert already presented
If request (3) has not re-used the SSL session from (1), then this is an
expected failure.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 44858] Systematic SSL session renegociation,
client cert, Firefox >= 2.0.13
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=44858
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #1 from Joe Orton <jo...@redhat.com> 2008-04-23 06:41:07 PST ---
Using "SSLOptions +OptRenegotiate" in the directory context should prevent
that, have you tried it?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org