0

Our case we are migrating sites from Apache 2.2 to 2.4, and follow a lot tips of this documentation: https://httpd.apache.org/docs/2.4/upgrading.html

But still not working fine redirecting the users to our 403 page ErrorDocument when cancel the certificate dialog box.

In Apache 2.2 this works, but in Apache 2.4 the rule not exit correctly with a Forbidden state:

RewriteEngine On 
RewriteCond %{SSL:SSL_CLIENT_VERIFY} !FAILED:(null) 
RewriteRule .* - [F]

In my virtualhost conf file have this errordocument pages (note: replaced IPs and fqdn names):

ErrorDocument 404 https://MYSITE.REPLA.CED/error_404.html
ErrorDocument 403 https://MYSITE.REPLA.CED/error_403.html
ErrorDocument 500 https://MYSITE.REPLA.CED/tempOutOfOrder.html
ErrorDocument 501 https://MYSITE.REPLA.CED/tempOutOfOrder.html
ErrorDocument 503 https://MYSITE.REPLA.CED/tempOutOfOrder.html

When I try and presents my certificate all works properly, but when in a new clean session without my certificate in browser cache, i.e. incognito mode, when appears the certificate dialog box to enter a website and press Cancel, this exception is not managed whith the Forbidden Rewrite directive.

My tracing when press Cancel are this (note: replaced IPs and fqdn and sensitive context):

80.190.80.190 - - [07/Nov/2020:19:25:06 +0100] "POST /mydircert HTTP/1.1" 200 5025 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3?response_type=code&client_id=tram.client_referer.cat&redirect_uri=http://10.20.10.20:8080/client-myapp/api/auth&scope=autenticacio_usuari&state=test&access_type=online&approval_prompt=auto" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/main.css HTTP/1.1" 200 8582 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/A10C9096DE9D1EFEC28D010376BD7434/logo.gif HTTP/1.1" 200 3261 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/img/logo_mycompany.png HTTP/1.1" 200 2234 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/img/alert.png HTTP/1.1" 200 1438 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/bootstrapMB.css HTTP/1.1" 200 9106 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/A10C9096DE9D1EFEC28D010376BD7434/myvalidatorIden.css HTTP/1.1" 200 11236 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXT3" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
80.190.80.190 - - [07/Nov/2020:19:25:07 +0100] "GET /mydircss/img/barra.png HTTP/1.1" 200 928 "https://MYSITE.REPLA.CED/CONTEXT1/CONTEXT2/CONTEXTCSS/A10C9096DE9D1EFEC28D010376BD7434/myvalidatorIden.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"

Apreciate that all traces are in acces log, any traces hace in error log, I supose that the Forbidden event writes i error log maybe?

Well, this is the case, the error handling when press Cancel button on certificate dialog box is broken in Apache 2.4, when the same code in Apache 2.2 works.

Many thanks in advance!

2
  • 1
    What is happening exactly? What is the string you are trying to match against (ie. the value of SSL:SSL_CLIENT_VERIFY)? Should this be a +ve match against "FAILED", rather than not "FAILED"? The parentheses in the CondPattern are either superfluous or an error. How is your 403 ErrorDocument defined?
    – MrWhite
    Nov 4, 2020 at 3:11
  • Hi @MrWhite, first thanks for try to help me. I recently added more information in my initial question. Thanks a lot Nov 7, 2020 at 18:53

0

You must log in to answer this question.

Browse other questions tagged .