Bug 60969

Summary: HTTP/2 & Certificate path can lead to 421
Product: Apache httpd-2 Reporter: Romain Lapoux <manus>
Component: mod_http2Assignee: Apache HTTPD Bugs Mailing List <bugs>
Status: NEW ---    
Severity: normal CC: huenig
Priority: P2    
Version: 2.4.25   
Target Milestone: ---   
Hardware: PC   
OS: All   

Description Romain Lapoux 2017-04-11 09:54:53 UTC 
If we setup 2 virtualhosts using the same certificate but using different path for the certificate Apache send 421 during browsing between both virtualhost.
Certificate is for *.mydomain.com
What is working:
<VirtualHost *:443>
ServerName test1.mydomain.com
SSLEngine on
SSLCertificateFile /home/test1.mydomain.com/ssl.cert
SSLCertificateKeyFile /home/test1.mydomain.com/ssl.key
SSLCACertificateFile /home/test1.mydomain.com/ssl.ca
</VirtualHost>
<VirtualHost *:443>
ServerName test2.mydomain.com
SSLEngine on
SSLCertificateFile /home/test1.mydomain.com/ssl.cert
SSLCertificateKeyFile /home/test1.mydomain.com/ssl.key
SSLCACertificateFile /home/test1.mydomain.com/ssl.ca
</VirtualHost>
What is not working (leading 421 if navigate between both virtualhost):
<VirtualHost *:443>
ServerName test1.mydomain.com
SSLEngine on
SSLCertificateFile /home/test1.mydomain.com/ssl.cert
SSLCertificateKeyFile /home/test1.mydomain.com/ssl.key
SSLCACertificateFile /home/test1.mydomain.com/ssl.ca
</VirtualHost>
<VirtualHost *:443>
ServerName test2.mydomain.com
SSLEngine on
SSLCertificateFile /home/test2.mydomain.com/ssl.cert
SSLCertificateKeyFile /home/test2.mydomain.com/ssl.key
SSLCACertificateFile /home/test2.mydomain.com/ssl.ca
</VirtualHost>
Comment 1 Jonas Hünig 2019-12-11 13:00:36 UTC 
Are there any plans for this? This would help us as well.
Comment 2 jaroslav 2020-08-28 15:52:02 UTC 
Also got hit by this. 

The most likely culprit is ssl_pk_server_compatible() in modules/ssl/ssl_engine_kernel.c - it checks for compatibility between vhosts by comparing certificate file name instead of certificate itself.

That leads to a situation where browser correctly decides (based on information available to it, namely subject alternative names) that it can reuse existing connection, but Apache disagrees and returns error 421.

(Some browsers try again as allowed by rfc7540 9.1.2, but some don't and show the error to the user.)
Comment 3 Joe Orton 2020-09-15 10:12:19 UTC 
Comment 2 looks right. It should be possible to enhance mod_ssl to do that, but it would be complicated, you'd have to iterate through the configured certs for the second context and compare with the currently used cert.  And this is a critical path which has numerous security issues in the past.

So, nobody is planning to touch it, and it's pretty trivial to adjust your configurations to avoid the issue in the first place.
Comment 4 Jonas Hünig 2020-09-15 11:25:39 UTC 
The issue is more, that you need to know that that configuration will create an issue.

As most browsers like Firefox and chrome work on the surface (you see the 421 in network tab) the website won't work at all with error-prone browsers like safari.

Another solution would be to see this as an invalid configuration and fail on configcheck here.