SSL connection between Apache and Tomcat failing

This is a multi-part message in MIME format.

------_=_NextPart_001_01CA06DD.FCE1EBC2
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I've got a website which uses Apache 2.2 as the front end with Tomcat
5.5.23 as the backend and am using mod_ssl and mod_proxy to link to the
two together in Windows server 2003. Normally there isn't an issue with
two servers serving the website but recently (and mainly with , it
appears, mobile browsers), I'm getting the following errors:

i Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1760): OpenSSL:
Loop: SSLv3 read finished A

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1756): OpenSSL:
Handshake: done

[Fri Jul 17 09:52:29 2009] [info] Connection: Client IP: 130.246.76.83,
Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits)

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1817): OpenSSL: read
5/5 bytes from BIO#7d0ad8 [mem: 4a3aaa8] (BIO dump follows)

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1750):
+----------------------------------------------------------- ------------
--+

Dump details ..... |

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1795):
+----------------------------------------------------------- ------------
--+

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1817): OpenSSL: read
992/992 bytes from BIO#7d0ad8 [mem: 4a3aaad] (BIO dump follows)

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1750):
+----------------------------------------------------------- ------------
--+

Dump details

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1795):
+----------------------------------------------------------- ------------
--+

[Fri Jul 17 09:52:29 2009] [info] Initial (No.1) HTTPS request received
for child 245 (server dev.jiscmail.ac.uk:443)

[Fri Jul 17 09:52:35 2009] [debug] ssl_engine_io.c(1828): OpenSSL: I/O
error, 5 bytes expected to read on BIO#73e708 [mem: 4a169e0]

[Fri Jul 17 09:52:35 2009] [info] [client 130.246.76.83] (OS 10060)A
connection attempt failed because the connected party did not properly
respond after a period of time, or established connection failed because
connected host has failed to respond. : SSL input filter read failed.

[Fri Jul 17 09:52:35 2009] [debug] ssl_engine_kernel.c(1770): OpenSSL:
Write: SSL negotiation finished successfully

I'd be grateful for any pointers in getting to the root of this issue
(or ruling out mod_ssl issues).

Thanks,

Iain

-- =0AScanned by iCritical.=0A

------_=_NextPart_001_01CA06DD.FCE1EBC2
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-GB link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

I’ve got a website which uses Apache 2.2 as =
the front
end with Tomcat 5.5.23 as the backend and am using mod_ssl and mod_proxy =
to
link to the two together in Windows server 2003. Normally there =
isn’t an
issue with two servers serving the website but recently (and mainly with =
, it appears,
mobile browsers), I’m getting the following errors:<o:p></o:p>

i Jul 17 09:52:29 2009] [debug] =
ssl_engine_kernel.c(1760):
OpenSSL: Loop: SSLv3 read finished A<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug]
ssl_engine_kernel.c(1756): OpenSSL: Handshake: done<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [info] Connection: =
Client IP:
130.246.76.83, Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 =
bits)<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug] =
ssl_engine_io.c(1817):
OpenSSL: read 5/5 bytes from BIO#7d0ad8 [mem: 4a3aaa8] (BIO dump =
follows)<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug] =
ssl_engine_io.c(1750):
+----------------------------------------------------------- -------------=
-+<o:p></o:p>

Dump =
details =
 &=
nbsp;
...... =
|<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug] =
ssl_engine_io.c(1795):
+----------------------------------------------------------- -------------=
-+<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug] =
ssl_engine_io.c(1817):
OpenSSL: read 992/992 bytes from BIO#7d0ad8 [mem: 4a3aaad] (BIO dump =
follows)<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [debug] =
ssl_engine_io.c(1750):
+----------------------------------------------------------- -------------=
-+<o:p></o:p>

Dump details<o:p></o:p>

 [Fri Jul 17 09:52:29 2009] [debug]
ssl_engine_io.c(1795):
+----------------------------------------------------------- -------------=
-+<o:p></o:p>

[Fri Jul 17 09:52:29 2009] [info] Initial (No.1) =
HTTPS
request received for child 245 (server =
dev.jiscmail.ac.uk:443)<o:p></o:p>

[Fri Jul 17 09:52:35 2009] [debug] =
ssl_engine_io.c(1828):
OpenSSL: I/O error, 5 bytes expected to read on BIO#73e708 [mem: =
4a169e0]<o:p></o:p>

[Fri Jul 17 09:52:35 2009] [info] [client =
130.246.76.83] (OS
10060)A connection attempt failed because the connected party did not =
properly
respond after a period of time, or established connection failed because
connected host has failed to respond. : SSL input filter read =
failed.<o:p></o:p>

[Fri Jul 17 09:52:35 2009] [debug]
ssl_engine_kernel.c(1770): OpenSSL: Write: SSL negotiation finished
successfully<o:p></o:p>

<o:p> </o:p>

I’d be grateful for any pointers in getting =
to the
root of this issue (or ruling out mod_ssl issues). <o:p></o:p>

<o:p> </o:p>

Thanks, <o:p></o:p>

<o:p> </o:p>

Iain<o:p></o:p>

</div>

 =
-- =0A Scanned by iCritical.=0A
 =
</body>

</html>

------_=_NextPart_001_01CA06DD.FCE1EBC2--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users [at] modssl.org
Automated List Manager majordomo [at] modssl.org

iain.emsley [ Fr, 17 Juli 2009 14:56 ] [ ID #2008972 ]

Re: SSL connection between Apache and Tomcat failing

------=_Part_127361_115640072.1247840031309
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Iain:

Wow! Am I glad to hear from you! I've been wrestling with exactly this prob=
lem - error on: OpenSSL: read 5/5 bytes from BIO - for a few weeks now; was=
beginning to think I was losing my mind. (while we leave that possibility =
aside for the moment(!),) here's what's different about our environment:

Apache/2.2.11 (Unix - Solaris SPARC) mod_ssl/2.2.11 OpenSSL/0.9.8k PHP/5.2.=
9 . We are using certificate authentication. Seeing this behavior under Fir=
efox (Mac); haven't tried it using mobile browsers, though, presumably, you=
may be using a Mozilla-based mobile browser... We've recently upgraded to =
these current versions of Apache and OpenSSL, but the error behavior has no=
t been impacted. The incessant prompting for certificate can be interrupted=
by setting Firefox's Advanced-Encryption-When a server requests my certifi=
cate-Select one automatically option. The above read error persists, howeve=
r...

The primary impact is - apparently - that the SSL session is constantly re-=
negotiated for GET of each page element; loading of a single page might gen=
erate 8-10 prompts for the certificate. We have fiddled with various settin=
gs for the Renogotiation buffer, including which buffer engine is used, its=
size, etc., all to no avail. Some of the settings result in Apache configu=
ration errors, so I wonder if we're into an Apache - or mod_ssl - 'black ho=
le' region.

My quick research on this indicates that others have run into it, some have=
simply ignored it, but none have solved it.

Hopefully we'll come up with something. Lou

----- Original Message -----
From: "I Emsley (Iain)" <iain.emsley [at] stfc.ac.uk>
To: modssl-users [at] modssl.org
Sent: Friday, July 17, 2009 8:56:23 AM GMT -05:00 US/Canada Eastern
Subject: SSL connection between Apache and Tomcat failing

I=E2=80=99ve got a website which uses Apache 2.2 as the front end with Tomc=
at 5.5.23 as the backend and am using mod_ssl and mod_proxy to link to the =
two together in Windows server 2003. Normally there isn=E2=80=99t an issue =
with two servers serving the website but recently (and mainly with , it app=
ears, mobile browsers), I=E2=80=99m getting the following errors:

i Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1760): OpenSSL: Loop: S=
SLv3 read finished A

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(1756): OpenSSL: Hand=
shake: done

[Fri Jul 17 09:52:29 2009] [info] Connection: Client IP: 130.246.76.83, Pro=
tocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits)

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1817): OpenSSL: read 5/5=
bytes from BIO

------=_Part_127361_115640072.1247840031309
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><style type=3D'text/css'>p { margin: 0; }</style></head><body><=
div style=3D'font-family: Arial; font-size: 12pt; color: #000000'>Iain: =
 Wow! Am I glad to hear from you! I've been wrestling with e=
xactly this problem - error on: OpenSSL: read 5/5 bytes from BIO - for a few wee=
ks now; was beginning to think I was losing my mind. (while we leave that p=
ossibility aside for the moment(!),) here's what's different about our envi=
ronment: Apache/2.2.11 (Unix - Solaris SPARC) mod_ssl/2.2.11 O=
penSSL/0.9.8k PHP/5.2.9. We are using certificate authenticati=
on. Seeing this behavior under Firefox (Mac); haven't tried it using mobile=
browsers, though, presumably, you may be using a Mozilla-based mobile brow=
ser... We've recently upgraded to these current versions of Apache an=
d OpenSSL, but the error behavior has not been impacted. The incessan=
t prompting for certificate can be interrupted by setting Firefox's Advance=
d-Encryption-When a server requests my certificate-Select one automatically=
option. The above read error persists, however... The primary=
impact is - apparently - that the SSL session is constantly re-negotiated for GET of each page element; lo=
ading of a single page might generate 8-10 prompts for the certificate.&nbs=
p; We have fiddled with various settings for the Renogotiation buffer, incl=
uding which buffer engine is used, its size, etc., all to no avail. S=
ome of the settings result in Apache configuration errors, so I wonder if w=
e're into an Apache - or mod_ssl - 'black hole' region. My quick res=
earch on this indicates that others have run into it, some have simply igno=
red it, but none have solved it. Hopefully we'll come up with someth=
ing. Lou ----- Original Message ----- Fro=
m: "I Emsley (Iain)" <iain.emsley [at] stfc.ac.uk> To: modssl-users [at] mod=
ssl.org Sent: Friday, July 17, 2009 8:56:23 AM GMT -05:00 US/Canada East=
ern Subject: SSL connection between Apache and Tomcat failing 

<style>

</style>


<div class=3D"Section1">

I=E2=80=99ve got a website which uses Apache 2.2 as =
the front
end with Tomcat 5.5.23 as the backend and am using mod_ssl and mod_proxy to
link to the two together in Windows server 2003. Normally there isn=E2=80=
=99t an
issue with two servers serving the website but recently (and mainly with , =
it appears,
mobile browsers), I=E2=80=99m getting the following errors:

i Jul 17 09:52:29 2009] [debug] ssl_engine_kernel.c(=
1760):
OpenSSL: Loop: SSLv3 read finished A

[Fri Jul 17 09:52:29 2009] [debug]
ssl_engine_kernel.c(1756): OpenSSL: Handshake: done

[Fri Jul 17 09:52:29 2009] [info] Connection: Client=
IP:
130.246.76.83, Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits)</=
p>

[Fri Jul 17 09:52:29 2009] [debug] ssl_engine_io.c(1=
817):
OpenSSL: read 5/5 bytes from BIO</div> </div></body></html>
------=_Part_127361_115640072.1247840031309--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users [at] modssl.org
Automated List Manager majordomo [at] modssl.org

Lou Picciano [ Fr, 17 Juli 2009 16:13 ] [ ID #2008974 ]

Please remove my email from the list

This is a multi-part message in MIME format.

------_=_NextPart_001_01CA06E9.04566E8E
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Please remove my email from the list

------_=_NextPart_001_01CA06E9.04566E8E
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<STYLE type=3Dtext/css>P {
MARGIN: 0px
}
</STYLE>

<META content=3D"MSHTML 6.00.2900.3492" name=3DGENERATOR></HEAD>
<BODY>
<DIV dir=3Dltr align=3Dleft>Please remove my
email from the list</DIV>
<DIV dir=3Dltr align=3Dleft> </DIV></BODY></HTML>

------_=_NextPart_001_01CA06E9.04566E8E--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users [at] modssl.org
Automated List Manager majordomo [at] modssl.org

liao.tan [ Fr, 17 Juli 2009 16:15 ] [ ID #2008975 ]