0

I have a server running many websites, each with SSL.
One of the sites is now refusing connections over SSL. This was previously working and I'm looking for assistance in determining what has been changed.

Here's the situation:
http://site1.com/ - works
https://site1.com/ - works
http://site2.com/ - works
https://site2.com/ - Doesn't work (but did previously)

Both sites are on the same server (Win Server 2003 SP2 - IIS6)

Both sites use certificates from the same authority and are both valid (according to IIS).

As far as I can tell, both sites have certificates configured identically in IIS. (Checked by a manual/visual check of properties, side by side)

Through use of OpenSSL I can see that there's a "ssl handshake failure" when trying to connect to site2 using https.

What could be the cause of this?

How can I investigate further?

Without SSL connections being available to this site, users are unable to log in or register. :(

disclaimer: I'm not a server admin and not responsible for the box. Yes, there are wider issues here but I need to get this working again first.

Edit
Through looking at the WireShark logs I can see that there is a checksum error in the Internet Protocol data when sending the Client Hello:

No.     Time        Source                Destination           Protocol Info
    119 5.734139    10.0.0.16             94.236.90.219         SSL      Client Hello

Frame 119: 112 bytes on wire (896 bits), 112 bytes captured (896 bits)
    Arrival Time: Jan  6, 2011 13:00:30.550690000 GMT Standard Time
    Epoch Time: 1294318830.550690000 seconds
    [Time delta from previous captured frame: 0.000460000 seconds]
    [Time delta from previous displayed frame: 0.000460000 seconds]
    [Time since reference or first frame: 5.734139000 seconds]
    Frame Number: 119
    Frame Length: 112 bytes (896 bits)
    Capture Length: 112 bytes (896 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp:ssl]
    [Coloring Rule Name: Checksum Errors]
    [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1 || mstp.checksum_bad==1]
Ethernet II, Src: Dell_ad:44:31 (b8:ac:6f:ad:44:31), Dst: Draytek_c5:c4:44 (00:50:7f:c5:c4:44)
    Destination: Draytek_c5:c4:44 (00:50:7f:c5:c4:44)
        Address: Draytek_c5:c4:44 (00:50:7f:c5:c4:44)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Dell_ad:44:31 (b8:ac:6f:ad:44:31)
        Address: Dell_ad:44:31 (b8:ac:6f:ad:44:31)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: 10.0.0.16 (10.0.0.16), Dst: 94.236.90.219 (94.236.90.219)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 98
    Identification: 0x0a94 (2708)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (6)
    Header checksum: 0x0000 [incorrect, should be 0x2c2b]
        [Good: False]
        [Bad: True]
            [Expert Info (Error/Checksum): Bad checksum]
                [Message: Bad checksum]
                [Severity level: Error]
                [Group: Checksum]
    Source: 10.0.0.16 (10.0.0.16)
    Destination: 94.236.90.219 (94.236.90.219)
Transmission Control Protocol, Src Port: 50108 (50108), Dst Port: https (443), Seq: 1, Ack: 1, Len: 58
Secure Socket Layer
    SSL Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: SSL 3.0 (0x0300)
        Length: 53
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 49
            Version: SSL 3.0 (0x0300)
            Random
                gmt_unix_time: Jan  6, 2011 13:00:33.000000000 GMT Standard Time
                random_bytes: 8b4a18cdfc3836100a7251faf181e09e8eea795c9df0b267...
            Session ID Length: 0
            Cipher Suites Length: 10
            Cipher Suites (5 suites)
                Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
                Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
                Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)
                Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
                Cipher Suite: Unknown (0x00ff)
            Compression Methods Length: 1
            Compression Methods (1 method)
                Compression Method: null (0)

And the response:

No.     Time        Source                Destination           Protocol Info
    122 5.756401    94.236.90.219         10.0.0.16             TCP      https > 50108 [FIN, ACK] Seq=1 Ack=59 Win=65477 Len=0

Frame 122: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
    Arrival Time: Jan  6, 2011 13:00:30.572952000 GMT Standard Time
    Epoch Time: 1294318830.572952000 seconds
    [Time delta from previous captured frame: 0.009587000 seconds]
    [Time delta from previous displayed frame: 0.022262000 seconds]
    [Time since reference or first frame: 5.756401000 seconds]
    Frame Number: 122
    Frame Length: 60 bytes (480 bits)
    Capture Length: 60 bytes (480 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:tcp]
    [Coloring Rule Name: TCP SYN/FIN]
    [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Draytek_c5:c4:44 (00:50:7f:c5:c4:44), Dst: Dell_ad:44:31 (b8:ac:6f:ad:44:31)
    Destination: Dell_ad:44:31 (b8:ac:6f:ad:44:31)
        Address: Dell_ad:44:31 (b8:ac:6f:ad:44:31)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: Draytek_c5:c4:44 (00:50:7f:c5:c4:44)
        Address: Draytek_c5:c4:44 (00:50:7f:c5:c4:44)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
    Trailer: 000000000000
Internet Protocol, Src: 94.236.90.219 (94.236.90.219), Dst: 10.0.0.16 (10.0.0.16)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 40
    Identification: 0x13f2 (5106)
    Flags: 0x02 (Don't Fragment)
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 115
    Protocol: TCP (6)
    Header checksum: 0x3007 [correct]
        [Good: True]
        [Bad: False]
    Source: 94.236.90.219 (94.236.90.219)
    Destination: 10.0.0.16 (10.0.0.16)
Transmission Control Protocol, Src Port: https (443), Dst Port: 50108 (50108), Seq: 1, Ack: 59, Len: 0

Edit 2
There is nothing being logged by IIS as it's not getting that far. It's a TCP level error.

Improve this question
4
  • Have you got any logs?
    – Ency
    Commented Jan 6, 2011 at 12:35
  • @Ency which logs?
    – Matt Lacey
    Commented Jan 6, 2011 at 13:05
  • eg. webservers log, everything what can help, because currently it is quite hard to help
    – Ency
    Commented Jan 6, 2011 at 13:18
  • @Ency some more details added. Part of my problem is knowing how to go about capturing useful information. This is a much lower level in the TCP stack than I'm used to working. :(
    – Matt Lacey
    Commented Jan 6, 2011 at 13:53

1 Answer 1

Reset to default
1

Try comparing wireshark results against data for the good site. I'm not sure if the checksum error is normal or not.

Some things to try:

  • Put the valid cert from the other site onto this site to rule out it being related to the cert itself
  • double check the bindings to make sure they haven't been changed. You need a unique IP for the https binding since you're using a different cert.
  • sometimes an unrelated things can mix things up. For example, if the page redirects to yet another site it may not be immediately obvious. Try testing against a test.html page to make sure that it's not related to the site code.
  • try a break test ... i.e. stop the site momentarily and make sure that the error changes, which will confirm that the bindings are working as expected.
Improve this answer
1
  • All good tips. Simply restarting the website seems to have solved the problem. (rather embarassingly)
    – Matt Lacey
    Commented Jan 6, 2011 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .