Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have written a IPP server in PHP running under Apache. With the standard IPP clients it works just fine. But when I try to print from an iOS device the connections breaks when the client tries to switch to TLS. This seems to be covered by RFC 2817 (Upgrading to TLS Within HTTP/1.1) and should be supported by Apache for years. What is wrong with my Apache config?

Apache SSL configuration:

SSLEngine optional
SSLCertificateFile /path/to/server.crt
SSLCertificateKeyFile /path/to/server.key


Connection: Upgrade
Host: iserv.local
Upgrade: TLS/1.0,SSL/2.0,SSL/3.0
User-Agent: CUPS/1.5.0


HTTP/1.1 200 OK
Server: Apache/2.2.16
Content-Length: 0
Content-Type: text/plain

Expected reply:

HTTP/1.1 101 Switching Protocol
Server: CUPS/1.4
Connection: Keep-Alive
Keep-Alive: timeout=30
Connection: Upgrade
Upgrade: TLS/1.0,HTTP/1.1
Content-Length: 0
share|improve this question
up vote 1 down vote accepted

As far as I'm aware, Apache Httpd has supported RFC 2817 since version 2.1.

To use it, you must use SSLEngine optional (instead of the more common SSLEngine on for HTTPS), as mentioned in the documentation.

EDIT (I hadn't realised you were already using SSLEngine optional):

It seems that this problem is specifically due to OPTIONS * HTTP/1.1. It will work when you send OPTIONS / HTTP/1.1 (or OPTIONS / HTTP/1.1) with the same upgrade headers.

After a bit more investigation, it seems that OPTIONS * simply doesn't work at all on recent versions of Apache Httpd (or at least it works differently).

If you try a Debian Etch (Apache Httpd 2.2.3), a simple OPTIONS * HTTP/1.1 (with a Host header) will give you a response with the Allow: GET,HEAD,POST,OPTIONS and Vary headers.

On a Debian Lenny (Apache Httpd 2.2.9, with a few extra backported security patches), and more recent versions, you won't get these Allow or Vary headers at all. You will get them with OPTIONS /.

I suspect something has changed in the way OPTIONS * was handled between these versions. (This may also have something to do with the problems mentioned in this thread.) This would certainly affect an RFC 2817 upgrade via OPTIONS *.

I would suggest asking on the Apache Httpd user or possibly dev list about this.

It sounds like it might be a bug. (Usage for OPTIONS * is quite rare, and so few clients support RFC 2817 that it might have simply have been unnoticed.)

share|improve this answer
I do use SSLEngine optional with Apache/2.2.16. :( – Jörg Ludwig Jun 14 '12 at 16:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.