git.net

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [users@httpd] {Resolved] SSL Handshake Exception in call from Android


I admit to knowing just enough about ssl/tls config to be dangerous.... When I first implemented SSL a couple of years ago, I had cloned the sslprotocol and cipher lines from a another httpd I was managing at the time (but did not set up...so no clue as to origin of the config).  It was working there, and it worked for me (at least with browsers).   It listed a bunch of cipher suites that I have no idea where they came from.  But obviously, it wasn't listing the one that Android was using.  Trying not to have to get a PhD in ssl/tls, I gave up trying to figure out from android docs what cipher would make android happy.  I decided to wipe out what I was using and replace with the default config specified in httpd_ssl.conf:

SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLHonorCipherOrder on
SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3
SSLPassPhraseDialog  builtin
SSLSessionCache        "shmcb:c:/wamp/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

This config worked.  Apparently in lieu of specifying individual ciphers, this says just use 'any high or medium cipher'.  Good enough for me if both android and httpd are happy.

On to the next problem....

Thanks as always for the help.

Jerry


On 11/2/2018 7:10 PM, Jerry Malcolm wrote:
Hi Jeffrey,  Thanks for the quick response.

I set the LogLevel to debug.  I'm getting a ton of debug info everywhere.  However, the https requests from my app are not even showing up in any logs.... not even the virtual host access or error logs or the apache system logs.  Nada... nothing.  As if the calls were never made.  Just to make sure there wasn't something else wrong, I changed https:// to http:// in my app, and everything works, including a ton of debug info in all of the logs.  But as soon as I use https, it looks like the requests aren't even making it into httpd.  But again.... the whole site works fine in https when using a browser.

Any ideas?  Am I not looking at the right place for the logs?

Jerry


On 11/2/2018 4:55 PM, Jeff Cauhape wrote:
Jerry,

Have you set LogLevel  to "debug" in httpd.conf and then check the sever error logs?
Could be helpful to see what the server is objecting to.

Jeffrey Cauhape – IT Professional III – Linux and Solaris Administrator
Nevada Department of Employment, Training and Rehabilitation
(775) 684-3804 (office)     jpcauhape@xxxxxxxxxxx

-----Original Message-----
From: Jerry Malcolm [mailto:techstuff@xxxxxxxxxxxx]
Sent: Friday, November 2, 2018 1:59 PM
To: users@xxxxxxxxxxxxxxxx
Subject: [users@httpd] SSL Handshake Exception in call from Android

I am writing an Android app that needs to make calls to my httpd server (Apache 2.4.33).  I am getting the following exception in my Android app:

Exception: javax.net.ssl.SSLHandshakeException:
javax.net.ssl.SSLProtocolException: SSL handshake aborted:
ssl=0x809adc78: Failure in SSL library, usually a protocol error
      error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure (external/openssl/ssl/s23_clnt.c:744
0x725e0cfc:0x00000000)

The same Android app calls Google Maps https with no problem and also calls another server with https that I do not own with no problem.  So I'm assuming I have something wrong in my httpd config.  But I need some help figuring it out.

The same web site responds just fine to https calls from browsers.  It just doesn't work when called from my Android app. It also works fine if I use http instead of https.  But I need https.

Suggestions as to what might be wrong?

Thx.

Jerry


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx