You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by David Bezjak <da...@wingenius.com> on 2004/02/04 00:07:45 UTC

[users@httpd] Apache mod_ssl bug?

It seems that I can't access (download) files like archives when I enable
https on my server.

I've now made the most basic example and it just won't work.

I've created this virtual host in my httpd.conf:

<VirtualHost *:443>
    ServerAdmin david@wingenius.com
    DocumentRoot /Apache2/htdocs/https
    ServerName 127.0.0.1:443
    ErrorLog logs/127.0.0.1.log
    CustomLog logs/127.0.0.1-access.log common
    SSLEngine On
    SSLCertificateFile conf/ssl/test.cer
    SSLCertificateKeyFile conf/ssl/test.pem
    SSLCACertificateFile conf/ssl/Equifax_Secure_Certificate_Authority.cer
</VirtualHost>

A very simple Virtual host.

And this is my index.html in the /Apache2/htdocs/https directory:

<HTML>
<HEAD>
</HEAD>
<BODY>
  <a href="foo.zip">Do you feel lucky?</a>
</BODY>
</HTML>

When I click "Do you feel lucky?". I get a file not found error.

"Internet Explorer cannot download foo.zip from..."

"..The requested site is either unavailable or cannot be found."

If I modify it slightly by changing port and remove the SSL lines in my
httpd.conf it works.

Please help! Any ideas?

Windows 2000
Apache 2.0.48

Regards David


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: [users@httpd] Apache mod_ssl bug?

Posted by David Bezjak <da...@wingenius.com>.
I solved my problem and posted my workaround earlier. It was an IE6 bug, but
thanks anyway.

/ David

---- Earlier post

Ok, I found it, it was a bug... In IE6 (anyone surprised?)

If you use mod_headers (as I did) with either (or both) of these headers
added:

Header add Pragma "no-cache" or Header add Cache-Control "no-cache"

You will get this error when using SSL and trying to download files.
According to this article:

http://support.microsoft.com/support/kb/articles/Q231/2/96.ASP

It should have been fixed ages ago, but.. well.. M$ haven't! I use IE
6.2800.1106 (latest at the time of writing). My personal fix for this
problem is to only use:

Header add Expires "Thu, 01 Dec 1994 16:00:00 GMT"

And hope that my content isn't cached in a way that makes my webapp unhappy.
Any other suggestions?

-----Original Message-----
From: Brian Dessent [mailto:brian@dessent.net] 
Sent: Wednesday, February 04, 2004 3:03 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache mod_ssl bug?

David Bezjak wrote:
> 
> Well. You might be right. I've never tried this configuration but I don't
> want to post the domain name (maybe it's microsoft.com ;) ) here.
> 
> Anyway, Redhat states that "ServerName directives in SSL virtual hosts
must
> explicitly specify the port number", in Apache2 that is:
> 
>
http://www.europe.redhat.com/documentation/rhl8.0/rhl-rg-en-8.0/s1-httpd-v2-
> mig.php3
> 
> I think it works both ways but ill do it the Redhat way.

You're probably right, I was thinking of something else.  It shouldn't
break it to include the port... but it shouldn't be necessary either.

Back to your actual problem... WHen you click on your foo.zip link,
what's in the server's access and error logs?  Does it work if you enter
an explicit URL, i.e. type https://localhost/foo.zip into the browser? 
Finally, are there any indications of SSL problems in the SSL log?

Brian

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Apache mod_ssl bug?

Posted by Brian Dessent <br...@dessent.net>.
David Bezjak wrote:
> 
> Well. You might be right. I've never tried this configuration but I don't
> want to post the domain name (maybe it's microsoft.com ;) ) here.
> 
> Anyway, Redhat states that "ServerName directives in SSL virtual hosts must
> explicitly specify the port number", in Apache2 that is:
> 
> http://www.europe.redhat.com/documentation/rhl8.0/rhl-rg-en-8.0/s1-httpd-v2-
> mig.php3
> 
> I think it works both ways but ill do it the Redhat way.

You're probably right, I was thinking of something else.  It shouldn't
break it to include the port... but it shouldn't be necessary either.

Back to your actual problem... WHen you click on your foo.zip link,
what's in the server's access and error logs?  Does it work if you enter
an explicit URL, i.e. type https://localhost/foo.zip into the browser? 
Finally, are there any indications of SSL problems in the SSL log?

Brian

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: [users@httpd] Apache mod_ssl bug?

Posted by David Bezjak <da...@wingenius.com>.
Well. You might be right. I've never tried this configuration but I don't
want to post the domain name (maybe it's microsoft.com ;) ) here.

Anyway, Redhat states that "ServerName directives in SSL virtual hosts must
explicitly specify the port number", in Apache2 that is:

http://www.europe.redhat.com/documentation/rhl8.0/rhl-rg-en-8.0/s1-httpd-v2-
mig.php3

I think it works both ways but ill do it the Redhat way. 

Anyone know the difference?

/David

-----Original Message-----
From: Brian Dessent [mailto:brian@dessent.net] 
Sent: Wednesday, February 04, 2004 8:02 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache mod_ssl bug?

David Bezjak wrote:

> <VirtualHost *:443>
>     ServerAdmin david@wingenius.com
>     DocumentRoot /Apache2/htdocs/https
>     ServerName 127.0.0.1:443

This is almost certainly wrong.  Servername should be "localhost" or
"127.0.0.1" if you don't want to give it a domain name but don't include
the port.

Brian

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Apache mod_ssl bug?

Posted by Brian Dessent <br...@dessent.net>.
David Bezjak wrote:

> <VirtualHost *:443>
>     ServerAdmin david@wingenius.com
>     DocumentRoot /Apache2/htdocs/https
>     ServerName 127.0.0.1:443

This is almost certainly wrong.  Servername should be "localhost" or
"127.0.0.1" if you don't want to give it a domain name but don't include
the port.

Brian

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: [users@httpd] Apache mod_ssl bug? (solved)

Posted by David Bezjak <da...@wingenius.com>.
Ok, I found it, it was a bug... In IE6 (anyone surprised?)

If you use mod_headers (as I did) with either (or both) of these headers
added:

Header add Pragma "no-cache" or Header add Cache-Control "no-cache"

You will get this error when using SSL and trying to download files.
According to this article:

http://support.microsoft.com/support/kb/articles/Q231/2/96.ASP

It should have been fixed ages ago, but.. well.. M$ haven't! I use IE
6.2800.1106 (latest at the time of writing).
My personal fix for this problem is to only use:

Header add Expires "Thu, 01 Dec 1994 16:00:00 GMT"

And hope that my content isn't cached in a way that makes my webapp unhappy.
Any other suggestions?


-----Original Message-----
From: David Bezjak [mailto:david@wingenius.com] 
Sent: Wednesday, February 04, 2004 12:08 AM
To: Users@Httpd. Apache. Org
Subject: [users@httpd] Apache mod_ssl bug?

It seems that I can't access (download) files like archives when I enable
https on my server.

I've now made the most basic example and it just won't work.

I've created this virtual host in my httpd.conf:

<VirtualHost *:443>
    ServerAdmin david@wingenius.com
    DocumentRoot /Apache2/htdocs/https
    ServerName 127.0.0.1:443
    ErrorLog logs/127.0.0.1.log
    CustomLog logs/127.0.0.1-access.log common
    SSLEngine On
    SSLCertificateFile conf/ssl/test.cer
    SSLCertificateKeyFile conf/ssl/test.pem
    SSLCACertificateFile conf/ssl/Equifax_Secure_Certificate_Authority.cer
</VirtualHost>

A very simple Virtual host.

And this is my index.html in the /Apache2/htdocs/https directory:

<HTML>
<HEAD>
</HEAD>
<BODY>
  <a href="foo.zip">Do you feel lucky?</a>
</BODY>
</HTML>

When I click "Do you feel lucky?". I get a file not found error.

"Internet Explorer cannot download foo.zip from..."

"..The requested site is either unavailable or cannot be found."

If I modify it slightly by changing port and remove the SSL lines in my
httpd.conf it works.

Please help! Any ideas?

Windows 2000
Apache 2.0.48

Regards David


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org