Friday, October 19, 2012

apache ssl warnings on client localhost

Have you seen these before?

[Fri Oct 19 18:48:22 2012] [info] Seeding PRNG with 1824 bytes of entropy
[Fri Oct 19 18:48:22 2012] [info] [client ::1] Connection to child 0 established (server tehsuck.de:80)


The reason for this is, that spawning a new process for every request is expensive (time and ressourcewise) and thus apache prespawns them and keeps them around. When it now manages this group of proces that all listen to a port and wait for a connection, it just wakes them by talking to them on the port specified last in the config.
Now maybe you have seen these:

[Sun Oct 14 09:55:39 2012] [info] Seeding PRNG with 1824 bytes of entropy
[Sun Oct 14 09:55:39 2012] [info] [client ::1] SSL library error 1 in handshake (server tehsuck.de:443)
[Sun Oct 14 09:55:39 2012] [info] SSL Library Error: 336027900 error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol speaking not SSL to HTTPS port!?


These are caused by the same process because the threadmanager apparently doesn't know SSL, so it tries to speak plain HTTP on port 443 which is wrong of course.
This is the result of
LISTEN *:80
LISTEN *:443
somewhere in your apache config.

So in order to turn the latter into the former swap the order and then to get rid of the messages use

SetEnvIf Remote_Addr "127\.0\.0\.1" loopback
SetEnvIf Remote_Addr "::1" loopback

and apped the follwing to your Customlog directive

env=!loopback

No comments:

Post a Comment