You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2018/09/07 13:13:11 UTC
[Bug 62691] New: OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
Bug ID: 62691
Summary: OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Product: Apache httpd-2
Version: 2.4.34
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_ssl
Assignee: bugs@httpd.apache.org
Reporter: wmperry@gmail.com
Target Milestone: ---
Working on a project and need an LTS version of OpenSSL, which is soon to be
1.1.1. Recompiled apache 2.4.34 against it and trying to use client
certificates shows a 1 minute delay between the handshake completing and the
0-byte SSL_peek() returning in ssl_engine_kernel.c:1033 returns.
Working just fine with OpenSSL 1.1.0 or 1.0.2, also appears to work without a
delay using the 1.1.1 openssl s_server command.
Minimal configuration file is:
------------
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so
LoadModule unixd_module /usr/lib/apache2/modules/mod_unixd.so
LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so
LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
SSLPassPhraseDialog "exec:......"
LogLevel trace5
ErrorLog /tmp/client-certificates.log
ServerName my.test.com
DocumentRoot /var/www
<Location />
SSLVerifyClient require
Require ssl-verify-client
</Location>
Listen 1443
<VirtualHost *:1443>
SSLEngine on
SSLCertificateKeyFile "/etc/xxxx.key"
SSLCertificateFile "/etc/xxxx.cert"
SSLCertificateChainFile "/etc/xxxx.cert"
SSLCACertificateFile "/etc/backendca.cert"
</VirtualHost>
------------
The logs from apache itself that shows the delay are:
[Tue Sep 04 18:58:14.886205 2018] [ssl:debug] [pid 2571:tid 140532252661504]
ssl_engine_kernel.c(2082): [client 172.16.1.101:53414] AH02041: Protocol:
TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
---- delay here ----
[Tue Sep 04 18:59:14.944591 2018] [ssl:trace4] [pid 2571:tid 140532252661504]
ssl_engine_io.c(2204): [client 172.16.1.101:53414] OpenSSL: read 0/5 bytes from
BIO#7fd014002a10 [mem: 7fd014002d43] (BIO dump follows)
There is no delay before the web browser / client prompts for a certificate to
use - just between the ssl re-handshake completing and the peek() returning no
bytes.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
--- Comment #6 from Joe Orton <jo...@redhat.com> ---
Note this is testing with TLSv1.2 not 1.3 - I will try to reproduce as well.
Can you stick "#warning foo" on a line directly before:
SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
in ssl_engine_init.c to make sure that is being enabled when you build?
Preferable to test against the 2.4.x branch now.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
--- Comment #5 from William Perry <wm...@gmail.com> ---
Moving "SSLVerifyClient require" outside of the <Location> block instantly
returns the document. So it does appear to be ONLY the renegotiation case.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
--- Comment #2 from William Perry <wm...@gmail.com> ---
Created attachment 36161
--> https://bz.apache.org/bugzilla/attachment.cgi?id=36161&action=edit
Trace5 logs of the renegotiation
I downloaded the latest on that branch as of a few days ago (, and the
behaviour is still the same. Full renegotiation is done, certificate is
verified, and then a timeout of 1 minute while the SSL_peek() fails. Attaching
logs @ trace5
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
William Perry <wm...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--- Comment #3 from William Perry <wm...@gmail.com> ---
Status back to 'new' - please let me know if you need any additional info.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
Stefan Eissing <st...@eissing.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #1 from Stefan Eissing <st...@eissing.org> ---
We are currently adding support for TLSv1.3 for the next 2.4.x release. If you
like, you can test your setup against
https://svn.apache.org/repos/asf/httpd/httpd/branches/tlsv1.3-for-2.4.x
to see if this delay has been eliminated by the recent changes in
renegotiation/client cert handling. Would be good to know. Thanks!
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
William Perry <wm...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |RESOLVED
Resolution|--- |FIXED
--- Comment #8 from William Perry <wm...@gmail.com> ---
Using the released OpenSSL 1.1.1 and the latest from 2.4.x seems to work
without any noticeable delay. Guess this one can go to resolved.
I was using 1.1.1-pre9. thanks.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
--- Comment #4 from Rainer Jung <ra...@kippdata.de> ---
Thanks for the logs. I can't currently promise to work on it myself, but some
info:
- the branch tlsv1.3-for-2.4.x has been merged just 3 days ago into the normal
2.4.x branch. So any further tests can be done against the normal branch,
unless something needs to get tested which might only exist in trunk, in which
case that would b the right source. The tlsv1.3-for-2.4.x should probably
considered stale starting now.
- what was the client you tested with?
- just to make sure: the hang only happens when "RE"negotation occurs due to
the VHost having different TLS config than the URI on that VHost that you are
trying to access (eg. the access to the VHost is not protected by client certs,
but some URLs are). To phrase it differently: when all of the vhost uses the
same ssl config including client certs, ciphers etc., then no hang occurs?
- As far as I understand this situation, previously handled by renegotiation,
gets handled in OpenSSL 1.1.1 by a post-handshake-authentication (PHA)
extension and support for PHA is not yet clear for all clients. Especially
clients using OpenSSL as their client TLS stack need to explicitly turn on PHA
when using OpenSSL 1.1.1. But that's only what I think I understood from other
discussions.
Thanks and regards,
Rainer
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 62691] OpenSSL 1.1.1 and client-certificate renegotiation
causes 1 minute delay
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62691
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #7 from Joe Orton <jo...@redhat.com> ---
I can't reproduce with 2.4.34+the TLS v1.3 patch from the branch, linked
against Fedora 29's OpenSSL 1.1.1.
Can you also test with the OpenSSL 1.1.1 final release - the original post was
dated before 1.1.1 was tagged - so I guess you were you testing with a -pre
release?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org