an error message in the logs that
says Invalid method in request !!!
Any help would be appreciated.
Red Hat Enterprise v.3 (64bit)
httpd-2.0.46, mod_ssl-2.0.46
openssl-0.9.7a, openssl096b-0.9.6b
Code from httpd.conf file:
==
Listen 0.0.0.0:443
VirtualHost _default_:443
Hello!
I'm using apache modssl and I'm not able to connect to port 443.
This problem is betwen server and client communication (HTTP versus
HTTPS), I think. But I don't know, how to solve this.
error_log:
Invalid method in request \x80L\x01\x03
host# /usr/bin/openssl s_client -connect myIP:443
Greetings,
I'm having problems getting SSL to work with Apache at the moment.
The message showing up the the error_log is:
Invalid method in request \x80\x80\x01\x03\x01
and openssl reports unknown protocol:s23_clnt.c:460:
Situation:
=
Sparc Solaris 9,
Apache 1.3.27
seeing it try to interpret the SSL/TLS handshake data from the client as
though it was a clear-text HTTP request, ie;
The message showing up the the error_log is:
Invalid method in request \x80\x80\x01\x03\x01
and your SSL/TLS client is getting a clear-text (bad request) response
from
What's wrong? When I connect to apache via
https, Netscape says Conection refused and there is invalid
method in request written in apache's error_log.
I'm using Apache 1.3.19 +
mod_ssl-2.8.1-1.3.19 + openssl-0.9.6.
Thanks
Pavel
--- Pavel_Hlou¹ek [EMAIL PROTECTED] wrote:
What's wrong? When I connect to apache via https, Netscape says
Conection refused and there is invalid method in request written
in apache's error_log.
I'm using Apache 1.3.19 + mod_ssl-2.8.1-1.3.19 + openssl-0.9.6.
Did you use GET? or maybe a form
I cannot connect to apache+mod_ssl with command recommended by
mod_ssl documentation (openssl s_client -connect localhost:443 -state
-debug). It results in a message in error_log of apache:
Ivalid method in request
Any idea?
Pavel Hlousek
On Fri, Mar 30, 2001, Pavel Hlouek wrote:
I cannot connect to apache+mod_ssl with command recommended by mod_ssl documentation
(openssl s_client -connect localhost:443 -state -debug
). It results in a message in error_log of apache:
Ivalid method in request
Any idea?
You connect with
, and the following is the error
message it logged into the error_log:
[error] [client x.x.x.x] Invalid method in request C
[error] [client x.x.x.x]Invalid method in request F
and for the access_log, its says:
- - [24/Mar/2000:11:04:51 -0800] "F" 501 -
Do you
I have enabled SSL on one of my virtual hosts. I have specified the
snakeoil certs and keys for now to test. When the browser goes to the
protected site, it just hangs. I am entering it with the https:// prefix.
In my error log, it says Invalid method in request and gives the client's
IP. I
it logged into the error_log:
[error] [client x.x.x.x] Invalid method in request C
[error] [client x.x.x.x]Invalid method in request F
and for the access_log, its says:
- - [24/Mar/2000:11:04:51 -0800] "F" 501 -
Do you know what could be the problem here? We
I faced the same trouble, on NT.
Fixed by simply restarting all the stuff on my side!
HTH
Daniel.
-Message d'origine-
De: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]De la part de jleung
Date: vendredi 24 mars 2000 20:52
À: [EMAIL PROTECTED]
Objet: Invalid method in request C or F
, and the following is the error
message it logged into the error_log:
[error] [client x.x.x.x] Invalid method in request C
[error] [client x.x.x.x]Invalid method in request F
and for the access_log, its says:
- - [24/Mar/2000:11:04:51 -0800] "F" 501 -
Do you
n the browser goes to the
protected site, it just hangs. I am entering it with the https:// prefix.
In my error log, it says Invalid method in request and gives the client's
IP. I have had this trouble now for quite some time and I thank anyone in
advance for hel
I have enabled SSL on one of my virtual hosts. I have specified the
snakeoil certs and keys for now to test. When the browser goes to the
protected site, it just hangs. I am entering it with the https:// prefix.
In my error log, it says Invalid method in request and gives the client's
IP. I
Invalid method in request and gives the client's
IP. I have had this trouble now for quite some time and I thank anyone in
advance for helping me with it.
Although you're connecting with HTTPS, on the HTTPS port your server
speaks only HTTP! Check your server configuration, please. Make sure
Listen
;make certificate".
The result is I get "Invalid method in request..." in my log file. Can someone
tell me what's going on?
__
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User
certificate, signed by a self-created ca.crt. I also tried
"make certificate".
The result is I get "Invalid method in request..." in my log file. Can someone
tell me what's going on?
This usually means you're speaking HTTPS to a port where only HTTP is spoken.
Check your
and 443. I can connect with standard http
fine, but when I try https, the client just hangs and I get the following
in the logs:
error_log:
" [error] [client x] Invalid method in request % "
access_log:
" x - - [21/Oct/1999:17:02:33 -0400] "%" 501 - "
try https, the client just hangs and I get the following
in the logs:
error_log:
" [error] [client x] Invalid method in request % "
access_log:
" x - - [21/Oct/1999:17:02:33 -0400] "%" 501 - "
So it's seeing a request for "%" from https, but no
the following
in the logs:
error_log:
" [error] [client x] Invalid method in request % "
access_log:
" x - - [21/Oct/1999:17:02:33 -0400] "%" 501 - "
So it's seeing a request for "%" from https, but not http ?
Hints appreciated.
TIA!
James Smallacombe
127.0.0.1 is just another interface. All possible errors can happen.
Imagine a server where the load is high enough that other processes don't
get to run much... they write to localhost, expecting what's on the other
end to get it, but the localhost interface buffers overflow.
Or the
SPASTIC Member wrote:
127.0.0.1 is just another interface. All possible errors can happen.
Imagine a server where the load is high enough that other processes don't
get to run much... they write to localhost, expecting what's on the other
end to get it, but the localhost interface buffers
On Wed, Nov 18, 1998, Ben Laurie wrote:
[...]
My $0.02, if it's worth anything. But if that's the way you code
Apache-SSL, I'm very glad my friend pointed me to mod_ssl.
If you want to use a system where programming errors are "corrected" by
removing the assertions that reveal them,
Ralf S. Engelschall wrote:
On Wed, Nov 18, 1998, Ben Laurie wrote:
[...]
My $0.02, if it's worth anything. But if that's the way you code
Apache-SSL, I'm very glad my friend pointed me to mod_ssl.
If you want to use a system where programming errors are "corrected" by
removing
On Sat, 31 Oct 1998, Ben Laurie wrote:
Ah, I also forgot to mention that an attacker with the ability to talk
to gcache can completely screw you with just legitimate messages - by
poisoning your cache. They can presumably also get access to session
keys. So, if anyone can talk to gcache
On Sat, 31 Oct 1998, Ben Laurie wrote:
This is far to general a criterion. Some kinds of I/O are completely
deterministic (given correct code). I agree that to assert on user input
is not a brilliant idea, but on a tightly linked client/server pair, it
seems to me no different to asserting
Marc Slemko wrote:
On Sat, 31 Oct 1998, Ben Laurie wrote:
Ah, I also forgot to mention that an attacker with the ability to talk
to gcache can completely screw you with just legitimate messages - by
poisoning your cache. They can presumably also get access to session
keys. So, if
On Sat, Oct 31, 1998, Ben Laurie wrote:
[...]
While you may think that the only way to run a SSL server is where no one
can login, no users can run any programs on it, etc. in the real world
that isn't always possible.
I have to say that my main interest is in secure servers. If people
Ralf S. Engelschall wrote:
On Sat, Oct 31, 1998, Ben Laurie wrote:
[...]
While you may think that the only way to run a SSL server is where no one
can login, no users can run any programs on it, etc. in the real world
that isn't always possible.
I have to say that my main
Ralf S. Engelschall wrote:
And now I ask me why _isn't_ this better? I don't understand it, Ben. IMHO
this non-assertion way _is_ better, because it prevents the system from being
dropped down (kind of DoS) by a local attacker
I'm happy to admit that is is a marginal improvement wrt a
On Fri, Oct 30, 1998, Ben Laurie wrote:
Ralf S. Engelschall wrote:
And now I ask me why _isn't_ this better? I don't understand it, Ben. IMHO
this non-assertion way _is_ better, because it prevents the system from being
dropped down (kind of DoS) by a local attacker
I'm happy to
Ah, I also forgot to mention that an attacker with the ability to talk
to gcache can completely screw you with just legitimate messages - by
poisoning your cache. They can presumably also get access to session
keys. So, if anyone can talk to gcache apart from Apache-SSL, you've had
it anyway.
On Sat, Oct 31, 1998, Ben Laurie wrote:
Ralf S. Engelschall wrote:
H??? Do you mean it cannot occur in practice? Or do I misunderstand you
here. As I said: We not even need an attacker: When an I/O read error occurs
for gcache it already falls down. So the DoS attacker is just the
On Sat, Oct 31, 1998, Ben Laurie wrote:
Ah, I also forgot to mention that an attacker with the ability to talk
to gcache can completely screw you with just legitimate messages - by
poisoning your cache. They can presumably also get access to session
keys. So, if anyone can talk to gcache
In article [EMAIL PROTECTED] you wrote:
[...a interesting discussion on the apache-ssl list with
Ben Laurie whether assertions in server code are reasonable or not...]
The discussion is pointless unless you can indicate a way in which it
makes Apache-SSL function incorrectly.
How about
On Fri, 30 Oct 1998, Ralf S. Engelschall wrote:
So on a typical system an attacker who gained access to _any_ account (not
necessarily the UID of the httpd or the gcache process) can simply dropping
down gcache and this way all httpds by just sending garbage to the gcache
port.
What does
37 matches
Mail list logo
