https://bz.apache.org/bugzilla/show_bug.cgi?id=70215
Jason Lingohr <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Jason Lingohr <[email protected]> --- Fixed in trunk as r1938527. I've added a new "Connection and Handshake Timeouts" section to the mod_ssl documentation, which explains that the HTTP-level timeouts (such as TimeOut) don't cover a client that stalls during the TLS handshake, and that you need to configure the handshake stage of mod_reqtimeout's RequestReadTimeout to time those connections out: RequestReadTimeout handshake=5 The handshake stage is disabled by default and has been available since httpd 2.4.39. I also added a cross-reference to RequestReadTimeout from the mod_ssl summary, and updated the RequestReadTimeout bullet in misc/security_tips.xml to call out the TLS handshake case. Thanks for the report. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
