Hi, I can access my SSL-only pages with a 'SSLVerifyClient require' client certificate with one problem. After starting Netscape the very first access of a https page will hang the browser. Selecting stop(or hitting ESC) followed by an immediate reload will access the page. All subsequent page accesses work fine. Each of my certificates works great. But the first access always hangs. I've save the apache_ssl_engine_log and noted where the browser hangs. Hopefully someone can tell me what is going on. I'm running apache/1.3.12 mod_ssl/2.6.6 and OpenSSL/0.9.4. The first trace seems to halt right above the Certificate Verification. Thanks for any help. TW ************* ************* [12/Oct/2000 17:16:03 02506] [info] Connection to child 5 established (server ssl.server.com:443, client 10.1.1.2) [12/Oct/2000 17:16:03 02506] [info] Seeding PRNG with 1160 bytes of entropy [12/Oct/2000 17:16:03 02506] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:16:03 02506] [trace] OpenSSL: Loop: before/accept initialization [12/Oct/2000 17:16:04 02506] [trace] OpenSSL: Loop: SSLv3 read client hello A [12/Oct/2000 17:16:04 02506] [trace] OpenSSL: Loop: SSLv3 write server hello A [12/Oct/2000 17:16:04 02506] [trace] OpenSSL: Loop: SSLv3 write certificate A [12/Oct/2000 17:16:04 02506] [trace] OpenSSL: Loop: SSLv3 write server done A [12/Oct/2000 17:16:04 02506] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 read client key exchange A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 read finished A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write change cipher spec A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write finished A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:16:07 02506] [trace] Inter-Process Session Cache (SHM) Expiry: old: 3, new: 1, removed: 2 [12/Oct/2000 17:16:07 02506] [trace] Inter-Process Session Cache: request=SET status=OK id=8691824D9F624FF20BF03BCF264DE1AAFBEA5A9136BF1AAFFC0445CD98561714 timeout=297s (session caching) [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Handshake: done [12/Oct/2000 17:16:07 02506] [info] Connection: Client IP: 10.1.1.2, Protocol: SSLv3, Cipher: RC4-MD5 (128/128 bits) [12/Oct/2000 17:16:07 02506] [info] Initial (No.1) HTTPS request received for child 5 (server ssl.server.com:443) [12/Oct/2000 17:16:07 02506] [trace] Changed client verification type will force renegotiation [12/Oct/2000 17:16:07 02506] [info] Requesting connection re-negotiation [12/Oct/2000 17:16:07 02506] [trace] Performing full renegotiation: complete handshake protocol [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSL renegotiate ciphers [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write hello request A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:16:07 02506] [info] Awaiting re-negotiation handshake [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: before accept initialization [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 read client hello A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write server hello A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write certificate A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write certificate request A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 write server done A [12/Oct/2000 17:16:07 02506] [trace] OpenSSL: Loop: SSLv3 flush data ************* ************* The broswer hangs here....note it hangs for 3.5 minutes waiting on the server. Whether I press esc immediately or wait 5 minutes the behaviour is the same. At this point I press ESC and the server logs the next 5 lines. ************* ************* [12/Oct/2000 17:19:43 02506] [trace] OpenSSL: Read: SSLv3 read client certificate A [12/Oct/2000 17:19:43 02506] [trace] OpenSSL: Exit: failed in SSLv3 read client certificate A [12/Oct/2000 17:19:43 02506] [error] Re-negotiation handshake failed: Not accepted by client!? [12/Oct/2000 17:19:43 02506] [trace] OpenSSL: Exit: error in SSLv3 read client certificate A [12/Oct/2000 17:19:43 02506] [info] Connection to child 5 closed with standard shutdown (server ssl.server.com:443, client 10.1.1.2) ************* ************* A reload and the page loads fine...here's the log messages from the sucessful page load... ************* ************* [12/Oct/2000 17:20:08 02499] [info] Connection to child 0 established (server ssl.server.com:443, client 10.1.1.2) [12/Oct/2000 17:20:08 02499] [info] Seeding PRNG with 1160 bytes of entropy [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: before/accept initialization [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 read client hello A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write server hello A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write certificate A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write server done A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 read client key exchange A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 read finished A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write change cipher spec A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write finished A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:20:08 02499] [trace] Inter-Process Session Cache (SHM) Expiry: old: 3, new: 2, removed: 1 [12/Oct/2000 17:20:08 02499] [trace] Inter-Process Session Cache: request=SET status=OK id=7B850C45C3A8775D14D519AA3CA305AEFEE525A220EE4A3DBD1BA0B07B55B983 timeout=300s (session caching) [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Handshake: done [12/Oct/2000 17:20:08 02499] [info] Connection: Client IP: 10.1.1.2, Protocol: SSLv3, Cipher: RC4-MD5 (128/128 bits) [12/Oct/2000 17:20:08 02499] [info] Initial (No.1) HTTPS request received for child 0 (server ssl.server.com:443) [12/Oct/2000 17:20:08 02499] [trace] Changed client verification type will force renegotiation [12/Oct/2000 17:20:08 02499] [info] Requesting connection re-negotiation [12/Oct/2000 17:20:08 02499] [trace] Performing full renegotiation: complete handshake protocol [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSL renegotiate ciphers [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write hello request A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:20:08 02499] [info] Awaiting re-negotiation handshake [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Handshake: start [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: before accept initialization [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 read client hello A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write server hello A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write certificate A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write certificate request A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 write server done A [12/Oct/2000 17:20:08 02499] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:20:11 02499] [trace] Certificate Verification: depth: 2, subject: /C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Freemail [EMAIL PROTECTED], issuer: /C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Freemail [EMAIL PROTECTED] [12/Oct/2000 17:20:11 02499] [trace] Certificate Verification: depth: 1, subject: /C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Certificate Services/CN=Personal Freemail RSA 1999.9.16, issuer: /C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Freemail [EMAIL PROTECTED] [12/Oct/2000 17:20:11 02499] [trace] Certificate Verification: depth: 0, subject: /CN=Thawte Freemail [EMAIL PROTECTED], issuer: /C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Certificate Services/CN=Personal Freemail RSA 1999.9.16 [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 read client certificate A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 read client key exchange A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 read certificate verify A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 read finished A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 write change cipher spec A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 write finished A [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Loop: SSLv3 flush data [12/Oct/2000 17:20:11 02499] [trace] Inter-Process Session Cache: request=SET status=OK id=5600F4D9C4982423D5230636106DBD82B43E631659958BFF3418B7F3DF8D8812 timeout=297s (session caching) [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Handshake: done [12/Oct/2000 17:20:11 02499] [info] Connection: Client IP: 10.1.1.2, Protocol: SSLv3, Cipher: RC4-MD5 (128/128 bits) [12/Oct/2000 17:20:11 02499] [trace] OpenSSL: Write: SSL negotiation finished successfully [12/Oct/2000 17:20:11 02499] [info] Connection to child 0 closed with standard shutdown (server ssl.server.com:443, client 10.1.1.2) ************* ************* That's it. _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com. ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
