TLS handshake times out for a few users onlyssl_error_bad_mac_alert error in FirefoxSSL site not using the correct IP in Apache and UbuntuApache certificates for some urls not workingRedirect user on SSL authentication failureChrome & IE not accepting client certificateRandom SSL Handshake failureMicrosoft .NET Framework and TLS 1.2 creates a 'Handshake Failure' with haproxySSL/TLS handshake failureTLS v1.3 active despite not being enabled in Nginx configtls 1.2 handshake timeout docker container
Shantae Dance Matching
Why Isn’t SQL More Refactorable?
Set collection doesn't always enforce uniqueness with the Date datatype? Does the following example seem correct?
Using column size much larger than necessary
Can an isometry leave entropy invariant?
Make some Prime Squares!
Have I damaged my car by attempting to reverse with hand/park brake up?
How do I overfit?
Manager is threatening to grade me poorly if I don't complete the project
How wide is a neg symbol, how to get the width for alignment?
Why was the battle set up *outside* Winterfell?
On which topic did Indiana Jones write his doctoral thesis?
What to use instead of cling film to wrap pastry
In Avengers 1, why does Thanos need Loki?
Getting a W on your transcript for grad school applications
How to model the curly cable part of the phone
Send iMessage from Firefox
What property of a BJT transistor makes it an amplifier?
How can I get a job without pushing my family's income into a higher tax bracket?
Expressing 'our' for objects belonging to our apartment
Why is B♯ higher than C♭ in 31-ET?
How does this change to the opportunity attack rule impact combat?
Can you complete the sequence?
Understanding trademark infringements in a world where many dictionary words are trademarks?
TLS handshake times out for a few users only
ssl_error_bad_mac_alert error in FirefoxSSL site not using the correct IP in Apache and UbuntuApache certificates for some urls not workingRedirect user on SSL authentication failureChrome & IE not accepting client certificateRandom SSL Handshake failureMicrosoft .NET Framework and TLS 1.2 creates a 'Handshake Failure' with haproxySSL/TLS handshake failureTLS v1.3 active despite not being enabled in Nginx configtls 1.2 handshake timeout docker container
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
A few of my clients are unable to visit any of my HTTPS-enabled websites. The browser spends a lot of time negotiating the TLS handshake. Ultimately, a timeout occurs.
The server: Apache2 on Ubuntu, SSL certificate from Let's Encrypt (which I do not think matters because the handshake fails). Several name-based hosts delivering a variety of sites, including static HTML sites and PHP sites, and reverse-proxying into Docker containers with a number of web applications (based on Ruby, Go, PHP).
The clients: Windows 7, Firefox 66 or Internet Explorer 11, with and without third-party antivirus/security software.
When one of my clients let me establish a remote session on their computer, I was able to see the problem on the client side myself. I watched the Apache2 error log (with LogLevel trace7) at the same time, it provided no meaningful information other than an eventual AH01998: Connection closed to child [x] with abortive shutdown.
The websites work fine for everyone else. They are indexed in the major search engines. SSL Labs does not show any problems with SSL/TLS configuration. I have attempted to reproduce the problem with a Windows 7 virtual box with Firefox and Internet Explorer, both of which were able to load the TLS-enabled websites without problem.
Things that I have tried, all to no avail:
- Turned off "internet security" software and restarted the client's browser (in the remote session).
- Disabled any custom SSL configuration in the Apache2 server (except the certificate configuration of course).
- Verified that the client's computer has plenty of free RAM (gigabytes).
- Verified that the client's IP addresses appear nowhere in the iptables of my server.
- Verified that the clients can see non-HTTPS-enabled sites on my server.
- Invoked the Firefox developer tools in the client's browser while attempting to load the page via HTTPS -- nothing to be seen.
- Upgraded the entire Ubuntu server from 18.04 with Apache2 2.4.29 and OpenSSL 1.1.0g to Ubuntu server 19.04 with Apache2 2.4.38 and OpenSSL 1.1.1b.
There are a few reports of failing TLS handshakes on the internet, but none of them provides a solution for this particular problem.
What else could I do to find out the cause of the problem?
ubuntu ssl apache-2.4 openssl timeout
asked Apr 24 at 7:41
bovenderbovender
1063
add a comment |
A few of my clients are unable to visit any of my HTTPS-enabled websites. The browser spends a lot of time negotiating the TLS handshake. Ultimately, a timeout occurs.
The server: Apache2 on Ubuntu, SSL certificate from Let's Encrypt (which I do not think matters because the handshake fails). Several name-based hosts delivering a variety of sites, including static HTML sites and PHP sites, and reverse-proxying into Docker containers with a number of web applications (based on Ruby, Go, PHP).
The clients: Windows 7, Firefox 66 or Internet Explorer 11, with and without third-party antivirus/security software.
When one of my clients let me establish a remote session on their computer, I was able to see the problem on the client side myself. I watched the Apache2 error log (with LogLevel trace7) at the same time, it provided no meaningful information other than an eventual AH01998: Connection closed to child [x] with abortive shutdown.
The websites work fine for everyone else. They are indexed in the major search engines. SSL Labs does not show any problems with SSL/TLS configuration. I have attempted to reproduce the problem with a Windows 7 virtual box with Firefox and Internet Explorer, both of which were able to load the TLS-enabled websites without problem.
Things that I have tried, all to no avail:
- Turned off "internet security" software and restarted the client's browser (in the remote session).
- Disabled any custom SSL configuration in the Apache2 server (except the certificate configuration of course).
- Verified that the client's computer has plenty of free RAM (gigabytes).
- Verified that the client's IP addresses appear nowhere in the iptables of my server.
- Verified that the clients can see non-HTTPS-enabled sites on my server.
- Invoked the Firefox developer tools in the client's browser while attempting to load the page via HTTPS -- nothing to be seen.
- Upgraded the entire Ubuntu server from 18.04 with Apache2 2.4.29 and OpenSSL 1.1.0g to Ubuntu server 19.04 with Apache2 2.4.38 and OpenSSL 1.1.1b.
There are a few reports of failing TLS handshakes on the internet, but none of them provides a solution for this particular problem.
What else could I do to find out the cause of the problem?
ubuntu ssl apache-2.4 openssl timeout
asked Apr 24 at 7:41
bovenderbovender
1063
2
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago
add a comment |
A few of my clients are unable to visit any of my HTTPS-enabled websites. The browser spends a lot of time negotiating the TLS handshake. Ultimately, a timeout occurs.
The server: Apache2 on Ubuntu, SSL certificate from Let's Encrypt (which I do not think matters because the handshake fails). Several name-based hosts delivering a variety of sites, including static HTML sites and PHP sites, and reverse-proxying into Docker containers with a number of web applications (based on Ruby, Go, PHP).
The clients: Windows 7, Firefox 66 or Internet Explorer 11, with and without third-party antivirus/security software.
When one of my clients let me establish a remote session on their computer, I was able to see the problem on the client side myself. I watched the Apache2 error log (with LogLevel trace7) at the same time, it provided no meaningful information other than an eventual AH01998: Connection closed to child [x] with abortive shutdown.
The websites work fine for everyone else. They are indexed in the major search engines. SSL Labs does not show any problems with SSL/TLS configuration. I have attempted to reproduce the problem with a Windows 7 virtual box with Firefox and Internet Explorer, both of which were able to load the TLS-enabled websites without problem.
Things that I have tried, all to no avail:
- Turned off "internet security" software and restarted the client's browser (in the remote session).
- Disabled any custom SSL configuration in the Apache2 server (except the certificate configuration of course).
- Verified that the client's computer has plenty of free RAM (gigabytes).
- Verified that the client's IP addresses appear nowhere in the iptables of my server.
- Verified that the clients can see non-HTTPS-enabled sites on my server.
- Invoked the Firefox developer tools in the client's browser while attempting to load the page via HTTPS -- nothing to be seen.
- Upgraded the entire Ubuntu server from 18.04 with Apache2 2.4.29 and OpenSSL 1.1.0g to Ubuntu server 19.04 with Apache2 2.4.38 and OpenSSL 1.1.1b.
There are a few reports of failing TLS handshakes on the internet, but none of them provides a solution for this particular problem.
What else could I do to find out the cause of the problem?
ubuntu ssl apache-2.4 openssl timeout
asked Apr 24 at 7:41
bovenderbovender
1063
A few of my clients are unable to visit any of my HTTPS-enabled websites. The browser spends a lot of time negotiating the TLS handshake. Ultimately, a timeout occurs.
The server: Apache2 on Ubuntu, SSL certificate from Let's Encrypt (which I do not think matters because the handshake fails). Several name-based hosts delivering a variety of sites, including static HTML sites and PHP sites, and reverse-proxying into Docker containers with a number of web applications (based on Ruby, Go, PHP).
The clients: Windows 7, Firefox 66 or Internet Explorer 11, with and without third-party antivirus/security software.
When one of my clients let me establish a remote session on their computer, I was able to see the problem on the client side myself. I watched the Apache2 error log (with LogLevel trace7) at the same time, it provided no meaningful information other than an eventual AH01998: Connection closed to child [x] with abortive shutdown.
The websites work fine for everyone else. They are indexed in the major search engines. SSL Labs does not show any problems with SSL/TLS configuration. I have attempted to reproduce the problem with a Windows 7 virtual box with Firefox and Internet Explorer, both of which were able to load the TLS-enabled websites without problem.
Things that I have tried, all to no avail:
- Turned off "internet security" software and restarted the client's browser (in the remote session).
- Disabled any custom SSL configuration in the Apache2 server (except the certificate configuration of course).
- Verified that the client's computer has plenty of free RAM (gigabytes).
- Verified that the client's IP addresses appear nowhere in the iptables of my server.
- Verified that the clients can see non-HTTPS-enabled sites on my server.
- Invoked the Firefox developer tools in the client's browser while attempting to load the page via HTTPS -- nothing to be seen.
- Upgraded the entire Ubuntu server from 18.04 with Apache2 2.4.29 and OpenSSL 1.1.0g to Ubuntu server 19.04 with Apache2 2.4.38 and OpenSSL 1.1.1b.
There are a few reports of failing TLS handshakes on the internet, but none of them provides a solution for this particular problem.
What else could I do to find out the cause of the problem?
ubuntu ssl apache-2.4 openssl timeout
ubuntu ssl apache-2.4 openssl timeout
asked Apr 24 at 7:41
bovenderbovender
1063
asked Apr 24 at 7:41
bovenderbovender
1063
asked Apr 24 at 7:41
bovenderbovender
1063
asked Apr 24 at 7:41
bovenderbovender
1063
asked Apr 24 at 7:41
bovenderbovender
1063
1063
2
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago
add a comment |
2
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago
2
2
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964356%2ftls-handshake-times-out-for-a-few-users-only%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964356%2ftls-handshake-times-out-for-a-few-users-only%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
From your description this looks more like a client side problem, like a corporate firewall there which interferes with the SSL or some IDS which for some reason generates false alarms and throws away packets. It would be useful to do packet captures both in the client side and on the server side and compare. My expectation would be that some data send by the client don't reach the server or some data send by the server don't reach the client.
– Steffen Ullrich
Apr 24 at 7:50
Thanks for the suggestion. We're not in a corporate environment, so no corporate firewall/IDS, but maybe the ISP interferes... I guess I'll have to capture the packets to find out.
– bovender
2 days ago