3

When I run this command:

openssl s_client -connect my.server:443 -starttls smtp

Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ?

What I see when I run the command from the clients end:

openssl s_client -connect my.server:443 -starttls smtp
Loading 'screen' into random state - done
CONNECTED(000001AC)

While OpenSSL is "CONNECTED" other connections from other workstations time out.

Any guidance would be appreciated

@Tom Leek, yeah I agree. So when I run the openssl command it sits at "CONNECTED", if ctrl+c I get the rest of the output from openssl

openssl s_client -connect my.server:443 -starttls smtp
Loading 'screen' into random state - done
CONNECTED(000001AC)
didn't found starttls in server response, try anyway...
bad select 10093
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
---
  • What do the Apache logs say? Anything in there that might be relevant? – S.L. Barth Jul 22 '15 at 18:21
  • 1
    @S.L.Barth With the Loglevel set to debug I see no real errors in the apache logs – KingBain Jul 22 '15 at 18:26
3

When I do openssl s_client -connect myservername:443 -starttls smtp, other clients are still supported just fine.

Of course, the connection from OpenSSL fails:

$ openssl s_client -connect myservername:443 -starttls smtp
CONNECTED(00000003)
didn't found starttls in server response, try anyway...
140029862278800:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 330 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
zsh: exit 1

because the -starttls smtp instructs openssl to use the STARTTLS command as per the SMTP protocol, and my server is a Web server, that talks HTTP (and HTTPS), not SMTP, and it has no idea what "STARTTLS" may mean.


If connecting from a client and doing this (improper, unsupported) STARTTLS actually freezes your whole server, then you have a big problem (namely, a really easy denial-of-service) that deserves thorough investigation, especially since, to my knowledge and as per my own tests, Apache+OpenSSL does not in general suffer from that kind of bug. In fact, given that Apache forks several sub-process to handle clients, and each process handles several (many) clients in parallel, it would be surprising that a bug in handling incorrect data from one client would really block all clients.

0

Adding these two lines to my httpd.conf seems to have resolved the issue:

AcceptFilter https none 
AcceptFilter http none 

The issue ended up not being specific to openssl but it did require the client to hold the connection open. I could create the same situtation using telnet.

c:\telnet myserver 80

Would block connections for other users as well

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.