Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Just starting out with managing an Apache server. Running into some issues while trying to integrate with a vendor API. I've verified all of the basic infrastructure issues (DNS, TCP ports, etc.) and have begun to suspect that SSL is the problem. The vendor API is configured to use DES-CBC3-SHA as its SSL cipher suite. I've verified that my host is able to complete the handshake using a manual connection via:

openssl s_client -ssl3 -connect vendor.somehost.com:443

I get the expected handshake and cert in the response. However, when I attempt connection through my application, I get a timeout. The application is RoR using Phusion Passenger. I have the following line in my httpd.conf:

SSLCipherSuite RC4-SHA:HIGH:!ADH:!AES256-SHA:!ECDHE-RSA-AES256-SHA384:!AES128-SHA:!DES-CBC3-SHA:!DES-CBC3-MD5:!IDEA-CBC-SHA:!RC4-MD5:!IDEA-CBC-MD5:!RC2-CBC-MD5:!MD5:!aNULL:!EDH:!AESGCM
SSLHonorCipherOrder on

This is intended to mitigate the BEAST vulnerability by restricting apache to stream rather than block ciphers. I'm curious if the apache settings are affecting the ability for outbound SSL connections to negotiate a 3DES cipher suite if they're restricted per the above.

A final sundry: Verified chain of trust for vendor's API (trust CA certs, intermediate CAs, etc.) Verified specific SSL/TLS protocol versions Application level stuff like passwords/tokens have all been confirmed

share|improve this question
1  
An SSL problem shouldn't cause a timeout.. are you sure the application's attempting its connection to the right place (verify with tcpdump)? –  Shane Madden Jan 15 '13 at 3:52
    
I'll give that a shot and see what it reveals. RoR claims it's a timeout. I have not checked with a protocol analyzer: SomeFunction::ConnectionError (The connection to the remote server timed out): lib/somefile.rb:42:in somestuff' lib/somefile.rb:22:in someotherstuff' app/controllers/someotherfile.rb:150:in `yetmorestuff' –  PaulM Jan 15 '13 at 4:28
    
Followed the flow in tcpdump. I see that the IP resolves properly, standard TCP handshake, SSL client hello, remote hosts sends ACK, local host sends back FIN ACK, remote host sends back RST, ACK after just a few milliseconds. However, since I saw the two packets after the Client hello, I'm no longer leaning towards a cipher issue. –  PaulM Jan 15 '13 at 12:07
    
Did the server send the Server Hello, or just that ACK? –  Shane Madden Jan 15 '13 at 16:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.