Re: F.Y.I HTTP spoken on HTTPS port; PROBLEM and SOLUTION

[Nikola Milutinovic]

Filip Sergeys tc wrote:

Hi,

Maybe somebody in the near or distant future will hit the same problem.
I hope this can help you avoiding it.

Error "HTTP spoken on HTTPS port" using apache 1.3.26 with mod_ssl,
mod_jk1.2 and tomcat 4.1.12.

If I understand correctly, a client has connected to the HTTPS port and insted of initializing a SSL handshake, started talking HTTP.

Error Description:
Requesting certain jsp pages via https gave us an error page back saying
we are trying to talk plain HTTP to a HTTPS server, while other pages
where served perfectly.
After long searching throug the access_logs and  ssl_engine_logs we
found that this caused the error: "sendRedirect"
Those pages that gave the error use "sendRedirect" in their code (we use
it to let one jsp page take the request and let another jsp page do the
respons).

Strange, but I guess you have determined that to be the cause. Or that cousing something else that leads to the error.

What does sendRedirect do?
sendRedirect launches a new HTTP request, and this request goes via
apache again(you can see it in the apache access_log). However this
request is in plain HTTP while the apache server is expecting HTTPS
request(see details below). This is, I presume, causing the error. If
somebody know the gory detail to this... I'm interested

Well, "sendRedirect" actaully doesn't launch another HTTP request - it is a job for the client to do so if it wishes. "sendRedirect" will send a HTTP response to the client of the form:

Status: 304 Redirect
Location: <location given in "sendRedirect">

The server then closes the request (HTTP/1.1 might leave the connection open, but the request is finished). The client may report on this or take further action in changing it's location to the one given in response. *The client will the initialte a new HTTP request* with the new location as URI.

(see access_log and ssl_engine_log)
Browser requests secure connection, handshake is successfull
Browser sends GET request to apache server for pageX.jsp over HTTPS
Apache decrypts and forwards request to tomcat using  mod_jk
Tomcat processes page and does sendRedirect.
New HTTP request is send to apache (while apache is still in HTTPS
session)
Try to do handshake again, fails. HTTP spoken on HTTPS port.
Error page is send back to browser.

This sounds like a browser error. BTW, I'm not up to speed with HTPPS, I thought it was just a plain HTTP over SSL connection. Is there some "session" element to it? Can you route two requests over HTTPS connection? Is HTTPS as a protocol different from HTTP?

Solution description
Replacing sendRedirect with request.forward function. This seems to keep
the forwarding inside of tomcat.

Sometimes internal and external redirects are interchangable. Sometimes the interchange is clumsy. Sometimes (two different web applications) impossible.

Nix.


--
To unsubscribe, e-mail: <mailto:tomcat-user-unsubscribe@;jakarta.apache.org>
For additional commands, e-mail: <mailto:tomcat-user-help@;jakarta.apache.org>