0

A coworker and I are trying to hash out a problem we're having with redirection over HTTPS, and I figure more eyes can't hurt. Our problem is as follows:

  • Client(192.168.0.1) and Host1(4.3.2.1) successfully negotiate a SSLv3.0 session.
  • Client(192.168.0.1) attempts to send HTTP data to Host1(4.3.2.1) and is redirected(307) to Host2(4.3.2.2)
  • HTTP data is never received by Host2(4.3.2.2)

Our knowledge of SSL is pretty decent, but the guy who was really well versed in it is no longer here, so bear with me. Here are our questions:

  1. Since we're redirecting over SSL, does the Host2(4.3.2.2) certificate common name need to match the common name on the Client's(192.168.0.1) cert?
  2. What are other issues that could be causing this problem?
4
  • So, what DOES happen when the client attempts to connect to the second host? Mar 12, 2013 at 19:18
  • @MichaelHampton The client and host2 perform a SSL negotiation with an encrypted SSL alert, but the negotiation completes successfully. After that the connection is closed and the data is not sent.
    – Joshua
    Mar 12, 2013 at 19:21
  • You should look at your web server error logs at host2 - it is normally quite explicit. What are they saying about that specific connection. Mar 12, 2013 at 19:35
  • There's no special interaction between HTTP redirects and TLS; the effect should be the same as the client directly going to host2. What happens if you do this?
    – mgorven
    Mar 12, 2013 at 20:20

1 Answer 1

1

You will re-initiate a communication toward the redirected hosts.

If you do :

1) User A request https://exampleA.com/redirect

2) https://exampleA.com/redirect 307 toward https://exampleB.com/redirect

3) User A request https://exampleB.com/redirect

in 1, you need successful SSL exchange with exampleA.com CN, in 3, you need successful SSL exchange with exampleB.com CN (if you are forwarding toward https, if forwarding to HTTP, you don't need it)

Also, be careful that 3 isn't redirecting toward 1, that create 'big & bad loops'.

Quick reminder: You negotiate SSL before you actually pass your virtual host data (except if you use SNI, which is quite rare). So you might have an issue if A and B are located on the same server, same IP, both on SSL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .