Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just configured the sites on my Windows Azure Hosted Ubuntu 12.04 Apache server to use SSL, the sites are working and redirecting correctly. Here is my virtual host configuration:

<VirtualHost *:80>
ServerName site1.company.com
Redirect permanent / https://site1.company.com/
</VirtualHost>

<VirtualHost *:443>
DocumentRoot /var/www/site1
ServerName site1.company.com
Options -Indexes
DirectoryIndex login.php
SSLEngine on
SSLCertificateFile /etc/apache2/certs/company.com.crt
SSLCertificateKeyFile /etc/apache2/certs/server1.key
SSLCertificateChainFile /etc/apache2/certs/gd_bundle.crt
</VirtualHost>

All virtual hosts are configured almost identically. However I'm seeing a LOT of entries in Apache's error log that has me worried about performance/issues during production.

[debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization
[debug] ssl_engine_io.c(1908): OpenSSL: I/O error, 11 bytes expected to read on BIO#7f8f746c6ae0     [mem: 7f8f746cc0d0]
[debug] ssl_engine_kernel.c(1903): OpenSSL: Exit: error in unknown state
[info] [client x.x.x.x] (70014)End of file found: SSL handshake interrupted by system [Hint: Stop button pressed in browser?!]
[info] [client x.x.x.x.] Connection closed to child 5 with abortive shutdown (server site1.company.com:443)
[info] [client x.x.x.x] Connection to child 0 established (server site1.company.com:443)
[info] Seeding PRNG with 656 bytes of entropy

This loop repeats itself every 15 seconds. Have I misconfigured something? All sites work correctly without errors.

share|improve this question
    
I just had a brilliant flash of insight.. The IP that was triggering the loop is based out of Hong Kong, it's 1 digit off from the Azure host's IP so I didn't think much of it, I just turned on the apache jail in fail2ban. –  Matt Bear Dec 18 '13 at 11:57
    
Now I'm wondering if there is more to this, the apache jail doesn't do anything. However I created a permaban list following the instructions at looke.ch/wp/list-based-permanent-bans-with-fail2ban, however apache will effectively lockup after less then a minute with both the apache jail and permaban turned on. –  Matt Bear Dec 18 '13 at 13:18
    
With only one, or the other enabled, there is no lockups. Could it be some sort of keep alive? –  Matt Bear Dec 18 '13 at 13:19

1 Answer 1

The mystery here has been solved, it was Azure's load balancer probe. I don't know why the IP address was reporting as registered in Hong Kong, but it makes a lot of sense now. I had to delete and recreate the endpoints in order to update the endpoints status and correct the issue.

It is all documented at http://social.msdn.microsoft.com/Forums/silverlight/en-US/04589d2d-4acb-4f86-a2d0-957dc2a73a4f/endpoints-not-working-dns-scans-them

This would of been a lot easier to figure out if 168.63.129.16 wasn't registered in Hong Kong (that was the ip that was hitting my server)

share|improve this answer
    
Um, it's not registered in Hong Kong. –  Michael Hampton Dec 18 '13 at 20:00
    
your right, that's strange... iplookup.net still reports it as Hong Kong though –  Matt Bear Dec 19 '13 at 19:32
    
That site is dead. Try another site. Anyway, it may actually be physically located in Hong Kong, but it's quite obviously a Microsoft IP address. –  Michael Hampton Dec 19 '13 at 20:02
    
sorry, ip-lookup.net, it's reporting it wrong I guess. –  Matt Bear Dec 19 '13 at 23:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.