Summary: | Reverse Proxy causing 500 error SSL proxy 1.0.1c OpenSSL | ||
---|---|---|---|
Product: | Apache httpd-2 | Reporter: | gibsonb |
Component: | mod_ssl | Assignee: | Apache HTTPD Bugs Mailing List <bugs> |
Status: | RESOLVED LATER | ||
Severity: | normal | Keywords: | MassUpdate |
Priority: | P2 | ||
Version: | 2.2.22 | ||
Target Milestone: | --- | ||
Hardware: | PC | ||
OS: | All |
Description
gibsonb
2012-07-27 12:48:05 UTC
you'll have to provide some details of the SSL connection between the two servers if you want it looked at as a bug in Apache. Not sure exactly what you mean, but I will post the configurations I'm using for the vhost: <VirtualHost server:443> ServerName arcgisproxy01dev SSLEngine on SSLProxyEngine on SSLCertificateChainFile chain.crt SSLCertificateFile site.crt SSLCertificateKeyFile site.key SSLOptions +StdEnvVars SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0 SetEnv proxy-initial-not-pooled 1 RewriteEngine on RewriteCond %{HTTP_HOST} !^arcgisproxy01dev [nocase] RewriteCond %{HTTP_HOST} !^$ RewriteRule ^/(.*) https://arcgisproxy01dev/$1 [redirect,last] ProxyRequests off # arcgis instance ProxyPassMatch (?i)^/arcgis/services(.*)$ https://arcgis01dev/arcgis/services/$1 ProxyPassReverse /arcgis/services https://arcgis01dev/arcgis/services ProxyPassMatch (?i)^/arcgis/rest(.*)$ https://arcgis01dev/arcgis/rest/$1 ProxyPassReverse /arcgis/rest https://arcgis01dev/arcgis/rest ProxyPassMatch (?i)^/arcgis/sdk/rest(.*)$ https://arcgis01dev/arcgis/sdk/rest/$1 ProxyPassReverse /arcgis/sdk/rest https://arcgis01dev/arcgis/sdk/rest ProxyPassMatch (?i)^/arcgis/tokens(.*)$ https://arcgis01dev/arcgis/tokens/$1 ProxyPassReverse /arcgis/tokens https://arcgis01dev/arcgis/tokens ProxyPassMatch (?i)^/arcgis/server/proxyoutput/(.*)$ https://arcgis01dev/proxyoutput/$1 ProxyPassReverse /arcgis/server/proxyoutput/ https://arcgis01dev/proxyoutput/ ProxyPassMatch (?i)^/arcgis/server/proxycache/(.*)$ https://arcgis01dev/proxycache/$1 ProxyPassReverse /arcgis/server/proxycache/ https://arcgis01dev/proxycache/ ProxyPassMatch (?i)^/arcgis/server/proxyjobs/(.*)$ https://arcgis01dev/proxyjobs/$1 ProxyPassReverse /arcgis/server/proxyjobs/ https://arcgis01dev/proxyjobs # public instance ProxyPassMatch (?i)^/public/services(.*)$ https://arcgis01dev/public/services/$1 ProxyPassReverse /public/services https://arcgis01dev/public/services ProxyPassMatch (?i)^/public/rest(.*)$ https://arcgis01dev/public/rest/$1 ProxyPassReverse /public/rest https://arcgis01dev/public/rest ProxyPassMatch (?i)^/public/sdk/rest(.*)$ https://arcgis01dev/public/sdk/rest/$1 ProxyPassReverse /public/sdk/rest https://arcgis01dev/public/sdk/rest ProxyPassMatch (?i)^/public/tokens(.*)$ https://arcgis01dev/public/tokens/$1 ProxyPassReverse /public/tokens https://arcgis01dev/public/tokens ProxyPassMatch (?i)^/public/server/proxyoutput/(.*)$ https://arcgis01dev/proxyoutput/$1 ProxyPassReverse /public/server/proxyoutput/ https://arcgis01dev/proxyoutput/ ProxyPassMatch (?i)^/public/server/proxycache/(.*)$ https://arcgis01dev/proxycache/$1 ProxyPassReverse /public/server/proxycache/ https://arcgis01dev/proxycache/ ProxyPassMatch (?i)^/public/server/proxyjobs/(.*)$ https://arcgis01dev/proxyjobs/$1 ProxyPassReverse /public/server/proxyjobs/ https://arcgis01dev/proxyjobs DocumentRoot /prj/web/arcgisproxy01dev/htdocs <Directory /prj/web/arcgisproxy01dev/htdocs> Options FollowSymLinks Includes AllowOverride All Order allow,deny Allow from all SSL</Directory> ScriptAlias /cgi-bin/ /prj/web/arcgisproxy01dev/cgi-bin/ <Directory /prj/web/arcgisproxy01dev/cgi-bin> AllowOverride AuthConfig Limit Options None Order allow,deny Allow from all SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 </Directory> ErrorLog ssl_error_log CustomLog ssl_access_log combined </VirtualHost> presumably there's a new SSL behavior over the wire, you'll have to capture it with e.g. ssldump and provide loglevel debug that corresponds to it Shootin from the hip: Could it be http://rt.openssl.org/index.html?q=2811 which was fixed after the OpenSSL 1.0.1c release in http://cvs.openssl.org/chngview?cn=22565 Regards, Rainer Please help us to refine our list of open and current defects; this is a mass update of old and inactive Bugzilla reports which reflect user error, already resolved defects, and still-existing defects in httpd. As repeatedly announced, the Apache HTTP Server Project has discontinued all development and patch review of the 2.2.x series of releases. The final release 2.2.34 was published in July 2017, and no further evaluation of bug reports or security risks will be considered or published for 2.2.x releases. All reports older than 2.4.x have been updated to status RESOLVED/LATER; no further action is expected unless the report still applies to a current version of httpd. If your report represented a question or confusion about how to use an httpd feature, an unexpected server behavior, problems building or installing httpd, or working with an external component (a third party module, browser etc.) we ask you to start by bringing your question to the User Support and Discussion mailing list, see [https://httpd.apache.org/lists.html#http-users] for details. Include a link to this Bugzilla report for completeness with your question. If your report was clearly a defect in httpd or a feature request, we ask that you retest using a modern httpd release (2.4.33 or later) released in the past year. If it can be reproduced, please reopen this bug and change the Version field above to the httpd version you have reconfirmed with. Your help in identifying defects or enhancements still applicable to the current httpd server software release is greatly appreciated. |