Just wanted to post an update (thanks to the responses on and off list I got about this)...
I was able to finally get a machine to replicate the problem and found some interesting behaviours. So we run 2 SSID's, once with a captive portal type system that uses DNS trickery to get there and one standard 802.1x secured network. In this case, the student had attached to the captive portal network a week earlier, and switched to our 802.1x network a few days later and all was working fine. When they brought us the laptop, we ran some tcpdumps to see what the client was attempting to do. What we found was interesting, upon loading Safari and requesting an HTTPS enabled site, the client made the calls to the dns server to lookup the oscp server to validate the certificate that it's presented from the site while connecting. However, prior to getting a response within a second, the client makes an HTTP GET request to our capitve portal redirect server. At this point I can see the user-agent string and it is the oscpd process making the call. As soon as the DNS query is returned, the oscp process sets up the tcp handshake fully, but never executes the HTTP GET to validate the certificate. Since the oscp process never completes / fails ... the page is never displayed So something is getting cached in the oscpd process... we did try to delete it's db files, but that didn't work either. I've sent it into Apple and are waiting a response. Just to give you a heads up... If I get any additional information I'll pass it along. Nicola ________________________________________ From: The EDUCAUSE Wireless Issues Constituent Group Listserv [[email protected]] on behalf of Foggi, Nicola [[email protected]] Sent: Thursday, September 11, 2014 4:14 PM To: [email protected] Subject: [WIRELESS-LAN] Another School Year .. Another Apple Problem - OS X 10.9.4 / Safari 7.0.6 Hey All, Just wanted to check to see if anyone else has run into this yet. Students have been back 2 days now for us and it seems we're potentially seeing a problem with OS X 10.9.4 / Safari 7.0.6 and SSL enabled websites. The problem apparently is apparently HTTPS enabled sites either won't load or load extremely slow. The reports I'm getting from the field is that switching users to FF or Chrome instantly solves the problem. One of the field guys dug up a problem similar from the 10.7 days where the fix was to disable OSCP and CRL services. That worked on one machine, but they are going to test another one. The problem of course is none of our test machines exhibit the problem (and getting students to stick around for additionally troubleshooting isn't happening either). Have those schools that started earlier run/seen/heard anything? I'm hoping to get my hands on a box that has the problem so I can get some logs to ship off to Apple, but I have a pretty weak case other than "hey hundreds of students have this problem but I can't give you any details". At least the 802.1x stability problem is fixed, so the students don't blame our 802.1x network as it appears on our WPA2-PSK network also :) Nicola ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
