Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A coworker and I are trying to hash out a problem we're having with redirection over HTTPS, and I figure more eyes can't hurt. Our problem is as follows:

  • Client(192.168.0.1) and Host1(4.3.2.1) successfully negotiate a SSLv3.0 session.
  • Client(192.168.0.1) attempts to send HTTP data to Host1(4.3.2.1) and is redirected(307) to Host2(4.3.2.2)
  • HTTP data is never received by Host2(4.3.2.2)

Our knowledge of SSL is pretty decent, but the guy who was really well versed in it is no longer here, so bear with me. Here are our questions:

  1. Since we're redirecting over SSL, does the Host2(4.3.2.2) certificate common name need to match the common name on the Client's(192.168.0.1) cert?
  2. What are other issues that could be causing this problem?
share|improve this question
    
So, what DOES happen when the client attempts to connect to the second host? –  Michael Hampton Mar 12 '13 at 19:18
    
@MichaelHampton The client and host2 perform a SSL negotiation with an encrypted SSL alert, but the negotiation completes successfully. After that the connection is closed and the data is not sent. –  Joshua Mar 12 '13 at 19:21
    
You should look at your web server error logs at host2 - it is normally quite explicit. What are they saying about that specific connection. –  CloudWeavers Mar 12 '13 at 19:35
    
There's no special interaction between HTTP redirects and TLS; the effect should be the same as the client directly going to host2. What happens if you do this? –  mgorven Mar 12 '13 at 20:20
add comment

1 Answer

You will re-initiate a communication toward the redirected hosts.

If you do :

1) User A request https://exampleA.com/redirect

2) https://exampleA.com/redirect 307 toward https://exampleB.com/redirect

3) User A request https://exampleB.com/redirect

in 1, you need successful SSL exchange with exampleA.com CN, in 3, you need successful SSL exchange with exampleB.com CN (if you are forwarding toward https, if forwarding to HTTP, you don't need it)

Also, be careful that 3 isn't redirecting toward 1, that create 'big & bad loops'.

Quick reminder: You negotiate SSL before you actually pass your virtual host data (except if you use SNI, which is quite rare). So you might have an issue if A and B are located on the same server, same IP, both on SSL.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.