openssl - Error in SSLv2/SSLv3 read client hello -
some background:
i trying setup reverse proxy internal business users site validation when external route down. able setup multiple routes corresponding virtualhosts entries in httpd.conf port 80 : anonymous user. afraid stuck @ ssl route , unable make progress. have been multiple forums unable find response assists me in moving further.
server details:
apache version: apache/2.2.29 (unix) linux version: $ cat /etc/*-release enterprise linux enterprise linux server release 5.8 (carthage) oracle linux server release 5.8 red hat enterprise linux server release 5.8 (tikanga)
problem:
when try access on ssl (*:443) empty response on 3 browsers (ie/chrome/firefox). note: generated self signed certificate following instructions @ how create , install apache self signed certificate.
troubleshooting
error log
[wed jul 08 23:16:06 2015] [notice] digest: generating secret digest authentication ... [wed jul 08 23:16:06 2015] [notice] digest: done [wed jul 08 23:16:06 2015] [debug] util_ldap.c(1990): ldap merging shared cache conf: shm=0x21b6ff0 rmm=0x21b7048 vhost: stgwww.cos.agilent.com [wed jul 08 23:16:06 2015] [debug] util_ldap.c(1990): ldap merging shared cache conf: shm=0x21b6ff0 rmm=0x21b7048 vhost: stgwww.cos.agilent.com [wed jul 08 23:16:06 2015] [info] apr ldap: built openldap ldap sdk [wed jul 08 23:16:06 2015] [info] ldap: ssl support available [wed jul 08 23:16:06 2015] [info] mod_unique_id: using ip addr 127.0.0.1 [wed jul 08 23:16:07 2015] [info] init: seeding prng 144 bytes of entropy [wed jul 08 23:16:07 2015] [info] loading certificate & private key of ssl-aware server [wed jul 08 23:16:07 2015] [debug] ssl_engine_pphrase.c(470): unencrypted rsa private key - pass phrase not required [wed jul 08 23:16:07 2015] [info] init: generating temporary rsa private keys (512/1024 bits) [wed jul 08 23:16:07 2015] [info] init: generating temporary dh parameters (512/1024 bits) [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(253): shmcb_init allocated 512000 bytes of shared memory [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(272): 511920 bytes (512000 including header), recommending 32 subcaches, 133 indexes each [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(306): shmcb_init_memory choices follow [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(308): subcache_num = 32 [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(310): subcache_size = 15992 [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(312): subcache_data_offset = 3208 [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(314): subcache_data_size = 12784 [wed jul 08 23:16:07 2015] [debug] ssl_scache_shmcb.c(316): index_num = 133 [wed jul 08 23:16:07 2015] [info] shared memory session cache initialised [wed jul 08 23:16:07 2015] [info] init: initializing (virtual) servers ssl [wed jul 08 23:16:07 2015] [info] configuring server ssl protocol [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(521): creating new ssl context (protocols: sslv3, tlsv1) [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(759): configuring permitted ssl ciphers [high:medium:!anull:!md5] [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(843): configuring server certificate chain (1 ca certificate) [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(890): configuring rsa server certificate [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(936): configuring rsa server private key [wed jul 08 23:16:07 2015] [debug] ssl_engine_init.c(521): creating new ssl context (protocols: sslv2, sslv3, tlsv1) [wed jul 08 23:16:07 2015] [info] mod_ssl/2.2.29 compiled against server: apache/2.2.29, library: openssl/0.9.8e-fips-rhel5 [wed jul 08 23:16:07 2015] [debug] proxy_util.c(1829): proxy: grabbed scoreboard slot 11 in child 6098 worker proxy:reverse [wed jul 08 23:16:07 2015] [debug] proxy_util.c(1945): proxy: initialized single connection worker 11 in child 6098 (*) --------- truncated ease of reading --------- [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] connection child 0 established (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] seeding prng 144 bytes of entropy [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1903): openssl: handshake: start [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1911): openssl: loop: before/accept initialization [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1939): openssl: read 11/11 bytes bio#22341b0 [mem: 223b880] (bio dump follows) [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1872): +-------------------------------------------------------------------------+ [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1911): | 0000: 43 4f 4e 4e 45 43 54 20-73 74 67 connect stg | [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1917): +-------------------------------------------------------------------------+ **[wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1940): openssl: exit: error in sslv2/v3 read client hello [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] ssl library error 1 in handshake (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] ssl library error: 336027803 error:1407609b:ssl routines:ssl23_get_client_hello:https proxy request speaking http https port!? [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] connection closed child 0 abortive shutdown (server stgwww.cos.agilent.com:443)** [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] connection child 1 established (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] seeding prng 144 bytes of entropy [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1903): openssl: handshake: start [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1911): openssl: loop: before/accept initialization [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1939): openssl: read 11/11 bytes bio#22341b0 [mem: 223b880] (bio dump follows) [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1872): +-------------------------------------------------------------------------+ [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1911): | 0000: 43 4f 4e 4e 45 43 54 20-73 74 67 connect stg | [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1917): +-------------------------------------------------------------------------+ [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1940): openssl: exit: error in sslv2/v3 read client hello [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] ssl library error 1 in handshake (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] ssl library error: 336027803 error:1407609b:ssl routines:ssl23_get_client_hello:https proxy request speaking http https port!? [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] connection closed child 1 abortive shutdown (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] [client 192.168.244.1] connection child 4 established (server stgwww.cos.agilent.com:443) [wed jul 08 23:19:02 2015] [info] seeding prng 144 bytes of entropy [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1903): openssl: handshake: start [wed jul 08 23:19:02 2015] [debug] ssl_engine_kernel.c(1911): openssl: loop: before/accept initialization [wed jul 08 23:19:02 2015] [debug] ssl_engine_io.c(1939): openssl: read 11/11 bytes bio#22341b0 [mem: 223b880] (bio dump follows) ===========
open ssl check
[sandeep@atgweb logs]$ openssl s_client -connect 192.168.244.129:443 -state -nbio connected(00000003) turning on non blocking io ssl_connect:before/connect initialization ssl_connect:sslv2/v3 write client hello **ssl_connect:error in sslv2/v3 read server hello write r block** ssl_connect:sslv3 read server hello depth=0 /c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com **verify error:num=18:self signed certificate** verify return:1 depth=0 /c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com verify return:1 ssl_connect:sslv3 read server certificate ssl_connect:sslv3 read server key exchange ssl_connect:sslv3 read server done ssl_connect:sslv3 write client key exchange ssl_connect:sslv3 write change cipher spec ssl_connect:sslv3 write finished ssl_connect:sslv3 flush data ssl_connect:error in sslv3 read finished ssl_connect:error in sslv3 read finished read r block ssl_connect:sslv3 read finished read r block --- certificate chain 0 s:/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com i:/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com 1 s:/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=atgweb.localvm.com/emailaddress=sandeep_rohilla@agilent.com i:/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=atgweb.localvm.com/emailaddress=sandeep_rohilla@agilent.com --- server certificate -----begin certificate----- miicvtccaiyccqdmbgmahqhtptanbgkqhkig9w0baqufadcbojelmakga1uebhmc vvmxezarbgnvbagtcknhbglmb3juawexejaqbgnvbactcun1cgvydglubzeqma4g a1uechmhqwdpbgvuddelmakga1uecxmcsvqxhzadbgnvbamtfnn0z3d3dy5jb3mu ywdpbgvudc5jb20xkjaobgkqhkig9w0bcqewg3nhbmrlzxbfcm9oawxsyubhz2ls zw50lmnvbtaefw0xnta3mdgxnzm2mzzafw0xnja3mdcxnzm2mzzamigimqswcqyd vqqgewjvuzetmbega1uecbmkq2fsawzvcm5pytesmbaga1uebxmjq3vwzxj0aw5v mrawdgydvqqkewdbz2lszw50mqswcqydvqqlewjjvdefmb0ga1ueaxmwc3rnd3d3 lmnvcy5hz2lszw50lmnvbteqmcggcsqgsib3dqejarybc2fuzgvlcf9yb2hpbgxh qgfnawxlbnquy29tmigfma0gcsqgsib3dqebaquaa4gnadcbiqkbgqdet9x5ck3g 5cgxz6rio1irzanqqqg2smddz3ntyglzotnp90xhhp1+vc6ud5hcivv2112+qcsa mvvjilkus+bv7gyipvvifosyoi5kaionkmyr5vyy1xrvfsrccf/jhylltoghdl+q 6ask51k3oujvka6urziaunuzgor5qhavkqidaqabma0gcsqgsib3dqebbquaa4gb abjqn06x+nvn8gzo9e+ywzhulyhjikryess3tepnbs4prgyhe2egzkeu1ooqui4w sf1toicvvuscolnsew1lscfneyk4ovdmazbkgv1dhs8dim7/uiquiorqlbq6dkjp uq9nhizrmm0j1mrj5gxrx0yqz8u/pym3xueagy7ktmyz -----end certificate----- subject=/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com issuer=/c=us/st=california/l=cupertino/o=agilent/ou=it/cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com --- no client certificate ca names sent --- ssl handshake has read 2509 bytes , written 319 bytes --- new, tlsv1/sslv3, cipher dhe-rsa-aes256-sha server public key 1024 bit secure renegotiation supported compression: none expansion: none ssl-session: protocol : tlsv1 cipher : dhe-rsa-aes256-sha session-id: ee96b79cc47110b9a7b242691f1721de77a3119f001cc88ce3b9befb4433d8d1 session-id-ctx: master-key: 30cb866077089fd7198dbd08eead9a98c58e43563a191fa2fa8e7a967963e4a614f53045c8528b0978abd0285acc41fe key-arg : none krb5 principal: none start time: 1436378586 timeout : 300 (sec) verify return code: 18 (self signed certificate) --- ssl3 alert read:warning:close notify closed ssl3 alert write:warning:close notify [sandeep@atgweb logs]$ cd .. [sandeep@atgweb apache2]$ cd bin [sandeep@atgweb bin]$ sudo ./apachectl -version server version: apache/2.2.29 (unix) server built: may 21 2015 21:05:01 httpd-ssl.conf file
#sslrandomseed startup file:/dev/random 512 #sslrandomseed startup file:/dev/urandom 512 #sslrandomseed connect file:/dev/random 512 #sslrandomseed connect file:/dev/urandom 512 listen 443 namevirtualhost *:443 # mime-types downloading certificates , crls addtype application/x-x509-ca-cert .crt addtype application/x-pkcs7-crl .crl sslpassphrasedialog builtin sslsessioncache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)" sslsessioncachetimeout 300 sslmutex "file:/usr/local/apache2/logs/ssl_mutex" ## ssl virtual host context <virtualhost _default_:443> # general setup virtual host documentroot "/usr/local/apache2/htdocs" servername xxxxx:443 serveradmin you@example.com errorlog "/usr/local/apache2/logs/error_log" transferlog "/usr/local/apache2/logs/access_log" # enable/disable ssl virtual host. sslengine on # ssl protocol support: sslprotocol -sslv2 # ssl cipher suite: sslciphersuite high:medium:!anull:!md5 # server certificate: sslcertificatefile "/usr/local/apache2/conf/ssl.crt" # server private key: sslcertificatekeyfile "/usr/local/apache2/conf/ssl.key" # server certificate chain: sslcertificatechainfile "/home/sandeep/sandeep.crt" <filesmatch "\.(cgi|shtml|phtml|php)$"> ssloptions +stdenvvars </filesmatch> <directory "/usr/local/apache2/cgi-bin"> ssloptions +stdenvvars </directory> browsermatch "msie [2-5]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 # per-server logging: customlog "/usr/local/apache2/logs/ssl_request_log" \ "%t %h %{ssl_protocol}x %{ssl_cipher}x \"%r\" %b" sslproxyengine on sslproxyverify none setenvif user-agent ".*msie.*" nokeepalive ssl-unclean-shutdown customlog logs/ssl_request_log \ "%t %h %{ssl_protocol}x %{ssl_cipher}x \"%r\" %b" proxypass / http://www.google.com proxypassreverse / http://www.google.com </virtualhost> modules enabled
loadmodule authn_file_module modules/mod_authn_file.so loadmodule authn_dbm_module modules/mod_authn_dbm.so loadmodule authn_anon_module modules/mod_authn_anon.so loadmodule authn_dbd_module modules/mod_authn_dbd.so loadmodule authn_default_module modules/mod_authn_default.so loadmodule authn_alias_module modules/mod_authn_alias.so loadmodule authz_host_module modules/mod_authz_host.so loadmodule authz_groupfile_module modules/mod_authz_groupfile.so loadmodule authz_user_module modules/mod_authz_user.so loadmodule authz_dbm_module modules/mod_authz_dbm.so loadmodule authz_owner_module modules/mod_authz_owner.so loadmodule authnz_ldap_module modules/mod_authnz_ldap.so loadmodule authz_default_module modules/mod_authz_default.so loadmodule auth_basic_module modules/mod_auth_basic.so loadmodule auth_digest_module modules/mod_auth_digest.so loadmodule file_cache_module modules/mod_file_cache.so loadmodule cache_module modules/mod_cache.so loadmodule disk_cache_module modules/mod_disk_cache.so loadmodule mem_cache_module modules/mod_mem_cache.so loadmodule dbd_module modules/mod_dbd.so loadmodule dumpio_module modules/mod_dumpio.so loadmodule echo_module modules/mod_echo.so loadmodule reqtimeout_module modules/mod_reqtimeout.so loadmodule ext_filter_module modules/mod_ext_filter.so loadmodule include_module modules/mod_include.so loadmodule filter_module modules/mod_filter.so loadmodule substitute_module modules/mod_substitute.so loadmodule charset_lite_module modules/mod_charset_lite.so loadmodule deflate_module modules/mod_deflate.so loadmodule ldap_module modules/mod_ldap.so loadmodule log_config_module modules/mod_log_config.so loadmodule log_forensic_module modules/mod_log_forensic.so loadmodule logio_module modules/mod_logio.so loadmodule env_module modules/mod_env.so loadmodule mime_magic_module modules/mod_mime_magic.so loadmodule cern_meta_module modules/mod_cern_meta.so loadmodule expires_module modules/mod_expires.so loadmodule headers_module modules/mod_headers.so loadmodule ident_module modules/mod_ident.so loadmodule usertrack_module modules/mod_usertrack.so loadmodule unique_id_module modules/mod_unique_id.so loadmodule setenvif_module modules/mod_setenvif.so loadmodule version_module modules/mod_version.so loadmodule proxy_module modules/mod_proxy.so loadmodule proxy_connect_module modules/mod_proxy_connect.so loadmodule proxy_ftp_module modules/mod_proxy_ftp.so loadmodule proxy_http_module modules/mod_proxy_http.so loadmodule proxy_scgi_module modules/mod_proxy_scgi.so loadmodule proxy_ajp_module modules/mod_proxy_ajp.so loadmodule proxy_balancer_module modules/mod_proxy_balancer.so loadmodule ssl_module modules/mod_ssl.so loadmodule mime_module modules/mod_mime.so loadmodule dav_module modules/mod_dav.so loadmodule status_module modules/mod_status.so loadmodule autoindex_module modules/mod_autoindex.so loadmodule asis_module modules/mod_asis.so loadmodule info_module modules/mod_info.so loadmodule cgi_module modules/mod_cgi.so loadmodule dav_fs_module modules/mod_dav_fs.so loadmodule dav_lock_module modules/mod_dav_lock.so loadmodule vhost_alias_module modules/mod_vhost_alias.so loadmodule negotiation_module modules/mod_negotiation.so loadmodule dir_module modules/mod_dir.so loadmodule imagemap_module modules/mod_imagemap.so loadmodule actions_module modules/mod_actions.so loadmodule speling_module modules/mod_speling.so loadmodule userdir_module modules/mod_userdir.so loadmodule alias_module modules/mod_alias.so loadmodule rewrite_module modules/mod_rewrite.so i appreciate on this. has been days have been hitting head wall. new this, if have missed basic apologies.
i used pbpaste on os x paste pem encoded cert s_client on clipboard (see below). connect openssl s_client -connect 192.168.244.129:443, 192.168.244.129 not subject alternate name.
you need fix names in server's certificate. create certificate server names in proper place browsers, see how create self-signed certificate openssl?. (don't worry self-signed vs csr - steps same).
the browsers still reject self-signed certificate. answer discusses why , how fix it.
related:
sslprotocol -sslv2shouldsslprotocol -sslv2 -sslv3sslciphersuite high:medium:!anull:!md5shouldsslciphersuite high:!anull:!md5:!rc4.sha1withrsaencryptionshould use sha256 , 2048 bit rsa moduli
$ pbpaste | openssl x509 -text -noout certificate: data: version: 1 (0x0) serial number: 16604219322008720293 (0xe66e09801d01d3a5) signature algorithm: sha1withrsaencryption issuer: c=us, st=california, l=cupertino, o=agilent, ou=it, cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com validity not before: jul 8 17:36:36 2015 gmt not after : jul 7 17:36:36 2016 gmt subject: c=us, st=california, l=cupertino, o=agilent, ou=it, cn=stgwww.cos.agilent.com/emailaddress=sandeep_rohilla@agilent.com subject public key info: public key algorithm: rsaencryption public-key: (1024 bit) modulus: 00:c4:4f:d5:f9:70:ad:c6:e4:28:31:cf:a4:48:a3: 58:ab:64:09:ea:41:08:36:b0:c7:43:67:79:d3:c8: 62:f3:39:33:69:f7:4c:61:1e:9d:7e:54:2e:ae:77: 91:dc:8a:fb:f6:d7:5d:be:40:2b:00:31:55:49:22: 59:14:b3:e6:ef:ee:0c:a2:3e:fb:e2:14:e4:b2:a2: 2e:4a:02:23:8d:92:6c:ab:e5:5c:b2:d5:7a:d5:7e: ca:c2:70:5f:c9:85:82:e5:b6:88:21:0e:5f:90:e9: ab:24:e7:52:b7:39:48:d5:91:ae:94:af:38:80:ba: 7b:b3:82:84:79:40:76:af:91 exponent: 65537 (0x10001) signature algorithm: sha1withrsaencryption 12:6a:9f:4e:97:fa:7b:cd:f2:06:68:f5:ef:b2:c1:98:54:97: 28:49:22:4a:d8:79:24:b7:b4:4a:67:05:2e:0f:44:6c:87:7b: 67:a0:64:a7:ae:d6:83:aa:b8:8e:30:49:fd:6d:a0:80:95:56: eb:02:a0:b9:d2:13:0d:65:49:c7:cd:11:89:38:a1:57:66:01: 90:4a:19:5d:5d:1d:2f:1d:20:ce:ff:50:84:2e:22:84:50:94: 14:3a:0e:42:69:ba:af:4d:1c:86:6b:98:cd:23:d4:ca:e3:e6: 0c:51:c7:46:2a:cf:c5:3f:a5:89:b7:5e:e1:00:83:2e:ca:4e: 66:33 
Comments
Post a Comment