You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "Jan-Frode Myklebust (JIRA)" <ji...@apache.org> on 2012/08/06 08:52:04 UTC
[jira] [Created] (TS-1392) requiring SNI for SSL termination
Jan-Frode Myklebust created TS-1392:
---------------------------------------
Summary: requiring SNI for SSL termination
Key: TS-1392
URL: https://issues.apache.org/jira/browse/TS-1392
Project: Traffic Server
Issue Type: Bug
Components: SSL
Affects Versions: 3.2.0
Environment: RHEL6, wildcard SSL certificate
Reporter: Jan-Frode Myklebust
It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "Leif Hedstrom (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429676#comment-13429676 ]
Leif Hedstrom commented on TS-1392:
-----------------------------------
Also, it works on XP if dest_ip=*, but specifying an IP does not work.
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "Leif Hedstrom (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429675#comment-13429675 ]
Leif Hedstrom commented on TS-1392:
-----------------------------------
Confirmed that this fails on Windows/XP with IE.
{code}
[Aug 6 20:42:27.364] Server {0x7f5c361d7700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 202 netvc 0x482e530
[Aug 6 20:42:27.364] Server {0x7f5c361d7700} DEBUG: (ssl) setting SNI callbacks with initial ctx 0x1908d80
[Aug 6 20:42:27.364] Server {0x7f5c361d7700} DEBUG: (ssl) ssl=0x1a98f00 ad=112 lookup=0xf05400 server=(null)
[Aug 6 20:42:27.364] Server {0x7f5c361d7700} DEBUG: (ssl) found SSL context 0x1908b40 for requested name '(null)'
[Aug 6 20:42:27.427] Server {0x7f5c361d7700} DEBUG: (ssl) SSLNetVConnection::sslServerHandShakeEvent, error
[Aug 6 20:42:27.428] Server {0x7f5c361d7700} ERROR: SSL ERROR: SSL_ServerHandShake.
[Aug 6 20:42:27.428] Server {0x7f5c361d7700} ERROR: SSL::9:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1235:
[Aug 6 20:42:27.428] Server {0x7f5c361d7700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 3 netvc 0x482e530
[Aug 6 20:42:27.432] Server {0x7f5c35dd3700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 202 netvc 0x488e530
[Aug 6 20:42:27.432] Server {0x7f5c35dd3700} DEBUG: (ssl) setting SNI callbacks with initial ctx 0x1908d80
[Aug 6 20:42:27.432] Server {0x7f5c35dd3700} DEBUG: (ssl) ssl=0x1a99900 ad=112 lookup=0xf05400 server=(null)
[Aug 6 20:42:27.432] Server {0x7f5c35dd3700} DEBUG: (ssl) found SSL context 0x1908b40 for requested name '(null)'
[Aug 6 20:42:27.444] Server {0x7f5c35dd3700} DEBUG: (ssl) SSLNetVConnection::sslServerHandShakeEvent, error
[Aug 6 20:42:27.444] Server {0x7f5c35dd3700} ERROR: SSL ERROR: SSL_ServerHandShake.
[Aug 6 20:42:27.444] Server {0x7f5c35dd3700} ERROR: SSL::13:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1235:
[Aug 6 20:42:27.444] Server {0x7f5c35dd3700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 3 netvc 0x488e530
[Aug 6 20:42:27.448] Server {0x7f5c35dd3700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 202 netvc 0x488e530
[Aug 6 20:42:27.448] Server {0x7f5c35dd3700} DEBUG: (ssl) setting SNI callbacks with initial ctx 0x1908d80
[Aug 6 20:42:27.448] Server {0x7f5c35dd3700} DEBUG: (ssl) SSLNetVConnection::sslServerHandShakeEvent, syscall
[Aug 6 20:42:27.448] Server {0x7f5c35dd3700} DEBUG: (ssl) [SSLNextProtocolAccept:mainEvent] event 3 netvc 0x488e530
{code}
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "Jan-Frode Myklebust (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13435870#comment-13435870 ]
Jan-Frode Myklebust commented on TS-1392:
-----------------------------------------
I can confirm that this patch resolved our problem on both the qualsys ssl-server-test, and also for our set-top-boxes. Thanks!
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "Leif Hedstrom (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429669#comment-13429669 ]
Leif Hedstrom commented on TS-1392:
-----------------------------------
Any IE version on Windows XP. You can probably install XP using your MSDN licenses in a VM :).
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (TS-1392) requiring SNI for SSL termination
Posted by "James Peach (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
James Peach resolved TS-1392.
-----------------------------
Resolution: Fixed
9c3bebd88eecf6aee1ce346b67460b8e1787752d TS-1392: Fix SNI certificate fallback path
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1392) requiring SNI for SSL termination
Posted by "Igor Galić (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Igor Galić updated TS-1392:
---------------------------
Backport to Version: (was: 3.2.3)
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1392) requiring SNI for SSL termination
Posted by "James Peach (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
James Peach updated TS-1392:
----------------------------
Backport to Version: 3.2.3
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "James Peach (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429683#comment-13429683 ]
James Peach commented on TS-1392:
---------------------------------
I think it's the same issue referred to in this thread: http://mail-archives.apache.org/mod_mbox/trafficserver-users/201207.mbox/%3c6490EFFD-910D-49E9-9466-1D0C72CB881D@apache.org%3e
When the SNI lookup fails, we fall back to a bad default SSL context instead of the context that we selected when we accepted the TCP connection.
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "James Peach (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429582#comment-13429582 ]
James Peach commented on TS-1392:
---------------------------------
Which client can I use to test non-SNI support?
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1392) requiring SNI for SSL termination
Posted by "Leif Hedstrom (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leif Hedstrom updated TS-1392:
------------------------------
Priority: Critical (was: Major)
Fix Version/s: 3.3.0
Assignee: James Peach
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TS-1392) requiring SNI for SSL termination
Posted by "James Peach (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13429782#comment-13429782 ]
James Peach commented on TS-1392:
---------------------------------
I think it's the same issue referred to in this thread: http://mail-archives.apache.org/mod_mbox/trafficserver-users/201207.mbox/%3c6490EFFD-910D-49E9-9466-1D0C72CB881D@apache.org%3e
When the SNI lookup fails, we fall back to a bad default SSL context instead of the context that we selected when we accepted the TCP connection.
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.0
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1392) requiring SNI for SSL termination
Posted by "Igor Galić (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Igor Galić updated TS-1392:
---------------------------
Fix Version/s: (was: 3.2.3)
3.3.1
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.3.1
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TS-1392) requiring SNI for SSL termination
Posted by "Igor Galić (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/TS-1392?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Igor Galić updated TS-1392:
---------------------------
Fix Version/s: (was: 3.3.0)
3.2.3
> requiring SNI for SSL termination
> ---------------------------------
>
> Key: TS-1392
> URL: https://issues.apache.org/jira/browse/TS-1392
> Project: Traffic Server
> Issue Type: Bug
> Components: SSL
> Affects Versions: 3.2.0
> Environment: RHEL6, wildcard SSL certificate
> Reporter: Jan-Frode Myklebust
> Assignee: James Peach
> Priority: Critical
> Fix For: 3.2.3
>
>
> It seems ATS require a Server Name Indication to complete the SSL handshake, ref: https://community.qualys.com/thread/10387
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira