Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

we migrated a server from slicehost to linode recently, we copied the config from one server to the other. Everything works perfectly except that we get:

Occasional errors with "Bad Request", this error is not common, you can use it all day and not see it, and the next day it will happen a lot.

apart from that, a lot of the time, event though the request works fine we get some errors.

using ssldump we get:

New TCP connection #1: myip(39831) <-> develserk(443)
1 1  0.2316 (0.2316)  C>S SSLv2 compatible client hello
  Version 3.1 
  cipher suites
  Unknown value 0x39  
  Unknown value 0x38  
  Unknown value 0x35  
  TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA  
  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA  
  TLS_RSA_WITH_3DES_EDE_CBC_SHA  
  SSL2_CK_3DES  
  Unknown value 0x33  
  Unknown value 0x32  
  Unknown value 0x2f  
  SSL2_CK_RC2  
  TLS_RSA_WITH_RC4_128_SHA  
  TLS_RSA_WITH_RC4_128_MD5  
  SSL2_CK_RC4  
  TLS_DHE_RSA_WITH_DES_CBC_SHA  
  TLS_DHE_DSS_WITH_DES_CBC_SHA  
  TLS_RSA_WITH_DES_CBC_SHA  
  SSL2_CK_DES  
  TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA  
  TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA  
  TLS_RSA_EXPORT_WITH_DES40_CBC_SHA  
  TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5  
  SSL2_CK_RC2_EXPORT40  
  TLS_RSA_EXPORT_WITH_RC4_40_MD5  
  SSL2_CK_RC4_EXPORT40  
1 2  0.2429 (0.0112)  S>C  Handshake
      ServerHello
        Version 3.1 
        session_id[32]=
          9a 1e ae c4 5f df 99 47 97 40 42 71 97 eb b9 14 
          96 2d 11 ac c0 00 15 67 4e f3 7d 65 4e c4 30 e9 
        cipherSuite         Unknown value 0x39
        compressionMethod                   NULL
1 3  0.2429 (0.0000)  S>C  Handshake
      Certificate
1 4  0.2429 (0.0000)  S>C  Handshake
      ServerKeyExchange
1 5  0.2429 (0.0000)  S>C  Handshake
      ServerHelloDone
1 6  0.4965 (0.2536)  C>S  Handshake
      ClientKeyExchange
1 7  0.4965 (0.0000)  C>S  ChangeCipherSpec
1 8  0.4965 (0.0000)  C>S  Handshake
1 9  0.5040 (0.0075)  S>C  ChangeCipherSpec
1 10 0.5040 (0.0000)  S>C  Handshake
ERROR: Length mismatch

from the apache error.log

[Fri Aug 27 14:50:05 2010] [debug] ssl_engine_io.c(1892): OpenSSL: I/O error, 5 bytes expected to read on BIO#b80c1e70 [mem: b8100918]

the server is ubuntu 10.04.1

the apache version is 2.2.14-5ubuntu8

the openssl version is 0.9.8k-7ubuntu8

share|improve this question
add comment

2 Answers

It appears that your SSL handshake is dieing during cipher negotiation.

I would check your SSLCipherSuite Apache configuration directive. The URL below points to the Apache documentation for this directive.

http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslciphersuite

Both sides have to support a common set of ciphers, or the connection will fail.

Hope this helps.

share|improve this answer
add comment

only listed the conf file for the 443 host, not the 80 host. I've copied it below:

NamevirtualHost *:80

DocumentRoot /var/www/

ServerName yeswedeal.com:80

ProxyPass / http://yeswedeal.com/ ProxyPassReverse / http//yeswedeal.com/

CustomLog /var/log/apache2/myservername-access.log combined ErrorLog /var/log/apache2/myservername-error.log

If I understand you correctly the rewrite syntax should go in the *:80 site rather than the *:443 site. Is that correct?

share|improve this answer
    
is this spam, or a mistake? –  Ruben Garat Sep 1 '10 at 18:56
    
i didnt got you Ruben if i have made any mistake in typing or writing .... –  Rajat Sep 1 '10 at 19:03
    
I just don't understand your answer, from what I can see it seems that you answered the wrong question by mistake. I never talked about rewrite syntax or anything like that. –  Ruben Garat Sep 1 '10 at 19:15
    
in your question you have ask for solution for the error which your getting, what i have understood you have change you host service from physical server to some other server on that your getting above said error for openssl if we need to resole the same i have just sent you a step to check if you left out the any think like that may be my english is not that good to explain .... –  Rajat Sep 1 '10 at 19:24
    
at my client place we had the same issues on that time i have done same of the change like that as i said in my answer!! –  Rajat Sep 1 '10 at 19:25
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.