I admit to knowing just enough about ssl/tls config to be dangerous....
When I first implemented SSL a couple of years ago, I had cloned the
sslprotocol and cipher lines from a another httpd I was managing at the
time (but did not set up...so no clue as to origin of the config). It
was working there, and it worked for me (at least with browsers). It
listed a bunch of cipher suites that I have no idea where they came
from. But obviously, it wasn't listing the one that Android was using.
Trying not to have to get a PhD in ssl/tls, I gave up trying to figure
out from android docs what cipher would make android happy. I decided
to wipe out what I was using and replace with the default config
specified in httpd_ssl.conf:
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLHonorCipherOrder on
SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:c:/wamp/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
This config worked. Apparently in lieu of specifying individual
ciphers, this says just use 'any high or medium cipher'. Good enough
for me if both android and httpd are happy.
On to the next problem....
Thanks as always for the help.
Jerry
On 11/2/2018 7:10 PM, Jerry Malcolm wrote:
Hi Jeffrey, Thanks for the quick response.
I set the LogLevel to debug. I'm getting a ton of debug info
everywhere. However, the https requests from my app are not even
showing up in any logs.... not even the virtual host access or error
logs or the apache system logs. Nada... nothing. As if the calls
were never made. Just to make sure there wasn't something else wrong,
I changed https:// to http:// in my app, and everything works,
including a ton of debug info in all of the logs. But as soon as I
use https, it looks like the requests aren't even making it into
httpd. But again.... the whole site works fine in https when using a
browser.
Any ideas? Am I not looking at the right place for the logs?
Jerry
On 11/2/2018 4:55 PM, Jeff Cauhape wrote:
Jerry,
Have you set LogLevel to "debug" in httpd.conf and then check the
sever error logs?
Could be helpful to see what the server is objecting to.
Jeffrey Cauhape – IT Professional III – Linux and Solaris Administrator
Nevada Department of Employment, Training and Rehabilitation
(775) 684-3804 (office) jpcauh...@detr.nv.gov
-----Original Message-----
From: Jerry Malcolm [mailto:techst...@malcolms.com]
Sent: Friday, November 2, 2018 1:59 PM
To: users@httpd.apache.org
Subject: [users@httpd] SSL Handshake Exception in call from Android
I am writing an Android app that needs to make calls to my httpd
server (Apache 2.4.33). I am getting the following exception in my
Android app:
Exception: javax.net.ssl.SSLHandshakeException:
javax.net.ssl.SSLProtocolException: SSL handshake aborted:
ssl=0x809adc78: Failure in SSL library, usually a protocol error
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert
handshake failure (external/openssl/ssl/s23_clnt.c:744
0x725e0cfc:0x00000000)
The same Android app calls Google Maps https with no problem and also
calls another server with https that I do not own with no problem.
So I'm assuming I have something wrong in my httpd config. But I
need some help figuring it out.
The same web site responds just fine to https calls from browsers.
It just doesn't work when called from my Android app. It also works
fine if I use http instead of https. But I need https.
Suggestions as to what might be wrong?
Thx.
Jerry
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org
