Hi, I have tried to read some of the old posts, but do not understand if the following is an apache or openssl question.
I am using the apache 2.2.14 mod_ssl with the patch: http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch When I test with openssl 0.9.8i the renegotiation is as expected: refused. When I use 0.9.8m-beta1 the Renegotiation hangs until the Timeout kicks in... with mod_ssl dynamically linked to 0.9.8i libs --- GET / HTTP/1.0 R RENEGOTIATING 28534:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:529: So this is perfect ... now the same with 0.9.8m libs --- GET / HTTP/1.0 R RENEGOTIATING ............hangs for 5 min .............. 25764:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record:s3_pkt.c:1202: In this case the error log (debug level) shows: [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_io.c(1884): OpenSSL: I/O error, 5 bytes expected to read on BIO#8e2d040 [mem: b71e9568] [Thu Jan 21 18:32:29 2010] [info] [client 192.168.1.190] (70007)The timeout specified has expired: SSL input filter read failed. [Thu Jan 21 18:32:29 2010] [error] [client 192.168.1.190] request failed: error reading the headers [Thu Jan 21 18:32:29 2010] [debug] ssl_engine_kernel.c(1879): OpenSSL: Write: SSL negotiation finished successfully Any ideas ? Rgds - Fred -- View this message in context: http://old.nabble.com/openssl-0.9.8m-beta1-with-modssl-patch-does-not-disable-renegotiation-tp27263857p27263857.html Sent from the OpenSSL - User mailing list archive at Nabble.com. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
