Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Using apache 2.2.3 on oracle enterprise linux.

When setting following setting in httpd.conf: Header edit Set-Cookie ^(.*)$ $1;Secure , cookie generation (which happens on our registration page) stops.

In certificate we have "Path Length Constraint=None" set. Its a L1C entrust cert. Can it be cause of it ?

share|improve this question
i would set the secure flag using a different method... Perhaps this is a better question for StackOverflow. – Rook Nov 14 '12 at 20:21
1  
It's nothing to do with the certificate. Try using a literal/static value in the cookie name, and check the headers coming out of the server. – symcbean Nov 16 '12 at 15:19
Just to be on the safe side: Is that cookie actually served via HTTPS? – Gumbo Nov 17 '12 at 17:18

2 Answers

up vote 1 down vote

There is no relationship between cookie processing, and certificate extensions. The path length constraint (in the Basic Constraint Extension of a CA certificate) enforces a limit on the length of the certificate path beyond that CA; with a path length constraint equal to 1, that CA certificate is good for issuing non-CA certificates (e.g. a certificate for a SSL server), but not for issuing other CA certificates.

Cookies occur at the HTTP level, when the SSL tunnel has been successfully established. There is no HTTP, hence no cookie at all, if something goes wrong with the SSL tunnel; conversely, when cookies come into action, everything already went fine with the SSL handshake, in particular the validation of the server certificate and the processing of certificate extensions that this entails.

share|improve this answer
up vote 0 down vote

It in the end turned out the issue with specific builds of Apache Installed on our webserver. Surprising all were 2.2.3 version, but some of the affected were having the release date previous than others.

Upgrading apache to same version resolved the issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.