Request Entity Too Large error while uploading files of more than 128KB over SSL
We have Apache 2.16 web servers where authentication is made via X509 client certificates (they come from chips cards). Here is the Directory configuration :
<Directory /directory> SSLVerifyClient optional SSLVerifyDepth 5 SSLRequireSSL SSLOptions +StdEnvVars +ExportCertData +OptRenegotiate </Directory>
The authentication run fine, but from times to times, when the user try to upload a file the upload fail, and we find this in the apache error log :
[Thu Dec 06 09:14:25 2012] [error] [client 18.104.22.168] Re-negotiation request failed [Thu Dec 06 09:14:25 2012] [error] SSL Library Error: 336068931 error:14080143:SSL routines:SSL3_ACCEPT:unsafe legacy renegotiation disabled [Thu Dec 06 09:14:25 2012] [error] [client 22.214.171.124] request body exceeds maximum size (131072) for SSL buffer [Thu Dec 06 09:14:25 2012] [error] [client 126.96.36.199] could not buffer message body to allow SSL renegotiation to proceed
But even using the SSLRenegBufferSize directive the user still have the bug (it's pure random). The big problem is I can't even reproduce the bug. The http client (browser) may be the difference between me and the user, I only have Firefox 17 under Linux, and I am collecting information from the user.
The optional value for SSLVerifyClient is needed since it allow our software to handle when a user don't have his certificate, or when a certificate is expired. Otherwise the browser just show a technical error page, not suitable to our users.