RE: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled?

2010-04-01 Thread Saju Paul
OptRenegotiate - enables avoidance of unnecessary handshakes by mod_ssl which also performs safe parameter checks. It is recommended to enable OptRenegotiate on a per directory basis. also performs safe parameter checks maybe the key. disable it and check if MSIE likes it. -Original

Re: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled?

2010-04-01 Thread Chris Clark
On Thu, Apr 1, 2010 at 3:11 AM, Jason Haar jason.h...@trimble.co.nz wrote: Hi there We have a CentOS-4.8 server that was upgraded to httpd-2.0.52-41.ent.7.centos4 this week - You need to upgrade Apache to httpd-2.2.15 (released March 6, 2010) Your version is years old. -Chris

Re: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled?

2010-04-01 Thread Jason Haar
On 04/01/2010 11:50 PM, Saju Paul wrote: OptRenegotiate - enables avoidance of unnecessary handshakes by mod_ssl which also performs safe parameter checks. It is recommended to enable OptRenegotiate on a per directory basis. also performs safe parameter checks maybe the key. disable it and

Re: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled?

2010-04-01 Thread Jason Haar
On 04/02/2010 02:21 AM, Chris Clark wrote: You need to upgrade Apache to httpd-2.2.15 (released March 6, 2010) Your version is years old. It is the official version released for CentOS-4.8 this week (which actually means Redhat too). It wouldn't surprise me if they never tested the client

Re: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled?

2010-04-01 Thread Jason Haar
On 04/02/2010 08:13 AM, Jason Haar wrote: On 04/02/2010 02:21 AM, Chris Clark wrote: You need to upgrade Apache to httpd-2.2.15 (released March 6, 2010) Your version is years old. OK, this is getting weird... I just created the same directory structure on a CentOS-5.3 server

Re: Apache SSL3_ACCEPT:unsafe legacy renegotiation disabled? [ANSWER]

2010-04-01 Thread Jason Haar
I found a fix. I'll be verbose to make this better for search engines :-) So after upgrading to httpd-2.0.52-41.ent.7.centos4 under CentOS-4.8 and/or httpd-2.2.3-31.el5.centos.4 under CentOS-5.3 our client-cert based authentication started failing for all versions of MSIE (Internet Explorer)