sqs / mod_gnutls

mod_gnutls (unofficial)
http://trustedhttp.org/wiki/TLS-SRP_in_Apache_mod_gnutls
Apache License 2.0
2 stars 0 forks source link

Handshake Failed errors repeatedly on apache2 #1

Open treii28 opened 6 years ago

treii28 commented 6 years ago

Getting multiple errors in the log on apache2.4.18 using I believe GnuTLS/3.4.9 (pulled using 'strings' from so file)

[Thu Apr 19 08:08:35.015454 2018] [gnutls:warn] [pid 28918] (103)Software caused connection abort: [client 100.100.100.100:64811] cleanup_gnutls_session: connection pool cleanup in progress but TLS session hasn't been terminated, trying to close

These types of errors showing up on/after specific client requests Multiple errors of type: [Thu Apr 19 08:28:35.665017 2018] [gnutls:error] [pid 28360] [client 100.100.100.100:50609] GnuTLS: Handshake Failed. Hit Maximum Attempts

NOTE: I did a google search and saw a number of mod_proxy related problems producing the second error. We do not have mod_proxy enabled.

configuration using comodo ssl keys:

        GnuTLSEnable On
        GnuTLSCache dbm        /var/cache/apache2/gnutls_cache
        GnuTlsCertificateFile      /etc/apache2/ssl/website.crt
        GnuTLSKeyFile              /etc/apache2/ssl/website.key
    GnuTLSClientCAFile      /etc/apache2/ssl/ca.txt
    GnuTLSPriorities    NONE:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+ECDHE-RSA:+DHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AES-256-CBC:+SIGN-RSA-SHA256:+SIGN-RSA-SHA384:+SIGN-RSA-SHA512:+SIGN-RSA-SHA224:+SIGN-RSA-SHA1:+SIGN-DSA-SHA256:+SIGN-DSA-SHA224:+SIGN-DSA-SHA1:+CURVE-ALL:+AEAD:+SHA256:+SHA384:+SHA1:+COMP-NULL   GnuTLSPriorities    NONE:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+ECDHE-RSA:+DHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AES-256-CBC:+SIGN-RSA-SHA256:+SIGN-RSA-SHA384:+SIGN-RSA-SHA512:+SIGN-RSA-SHA224:+SIGN-RSA-SHA1:+SIGN-DSA-SHA256:+SIGN-DSA-SHA224:+SIGN-DSA-SHA1:+CURVE-ALL:+AEAD:+SHA256:+SHA384:+SHA1:+COMP-NULL
sqs commented 6 years ago

Sorry you are seeing issues. I haven’t worked on this in years. I have been meaning to archive this project. I won’t be able to help but I would happily accept PRs.