You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2006/03/20 10:01:14 UTC
DO NOT REPLY [Bug 12355] - SSLVerifyClient directive in location make post to PHP script impossible
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=12355>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=12355
yefym.dmukh@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
------- Additional Comments From yefym.dmukh@gmail.com 2006-03-20 09:00 -------
(In reply to comment #43)
> (In reply to comment #41)
>
> > This patch can be applied to 2.0.54.
>
> The patch can be applied to 2.0.55 aswell, and it allows using the
> following setup:
>
> SSLVerifyClient optional
> <Location /subversion>
> DAV svn
> SVNParentPath /path/to/reps
> AuthzSVNAccessFile /path/to/accessfile
> SSLVerifyClient require
> SSLUserName SSL_CLIENT_S_DN_CN
> SSLOptions +StrictRequire
> </Location>
>
> I used Subversion 1.2.3 clients on Linux and Windows for successful
> testing.
>
> It is important to note that with the above configuration, access to
> the Subversion repository requires a client certificate, while other
> areas of the server can be accessed without certificates (i.e. webmail
> via HTTPS). Judging from my tests, this desired behaviour can not be
> achieved based on vanilla 2.0.55 sources, so I strongly welcome Joe's
> patch and hope it will be included as a 2.0.x backport in the future.
The problem is still not fixed. Was tested for apache 2.0.55 :
there is still post method not allowed message described by you and other guys
in this topic.
After patching apache it still doesn`t work, only the message is different.
We tried with apache_2.0.55 with unofficial patch from bugzilla (No.:12355) and
got the following messages in logfiles.
access_log:
85.115.6.202 - - [17/Mar/2006:13:13:50 +0000] "POST
/webservice/services/SessionManagement HTTP/1.0" 403 - "-"
"-"
error_log with debug level in http.conf:
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1738): OpenSSL:
Handshake: start
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1746): OpenSSL: Loop: SSL
renegotiate ciphers
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1746): OpenSSL: Loop:
SSLv3 write hello request
A
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1746): OpenSSL: Loop:
SSLv3 flush data
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1746): OpenSSL: Loop:
SSLv3 write hello request
C
[Fri Mar 17 13:32:54 2006] [info] Awaiting re-negotiation handshake
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1738): OpenSSL:
Handshake: start
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1746): OpenSSL: Loop:
before accept initializati
on
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_io.c(1697): OpenSSL: read 0/5
bytes from BIO#83a24b8 [mem
: 842d708] (BIO dump follows)
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_io.c(1644):
+--------------------------------------------
-----------------------------+
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_io.c(1675):
+--------------------------------------------
-----------------------------+
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_kernel.c(1770): OpenSSL: Exit:
failed in SSLv3 read clien
t hello B
[Fri Mar 17 13:32:54 2006] [error] Re-negotiation handshake failed: Not accepted
by client!?
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_io.c(1488): [client 85.115.6.202]
read from buffered SSL
brigade, mode 0, 8192 bytes
[Fri Mar 17 13:32:54 2006] [debug] ssl_engine_io.c(1550): [client 85.115.6.202]
buffered SSL brigade no
w exhausted; removing filter
[Fri Mar 17 13:33:07 2006] [debug] ssl_engine_io.c(1708): OpenSSL: I/O error, 5
bytes expected to read
on BIO#83a24b8 [mem: 842d708]
[Fri Mar 17 13:33:07 2006] [info] (70007)The timeout specified has expired: SSL
input filter read faile
d.
[Fri Mar 17 13:33:07 2006] [debug] ssl_engine_kernel.c(1756): OpenSSL: Write:
SSL negotiation finished
successfully
[Fri Mar 17 13:33:07 2006] [info] Connection to child 2 closed with standard
shutdown(server drecord.de
.something.com:443, client 85.115.6.202)
--------------------------------------------------------------------------------
P.S.
We have additional virtualhost configured that is responsible for certificate
authentication and session management with axis, there it works perfectly. So
the problem occures only for <location> that doesn`t have a globaly set
<SSLVerifyClient> to optional or required
P.P.S.
<SSLVerifyClient> optional in a global context fix the problem , but this
solution is not acceptable because it enforce the browser to show the popup with
installed certificates.(sure it is a browser issue and probably could be
configured on the client side, but this is not the way it should work in
productive env.)
Regards, Yefym
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org