5

We have a web portal setup on Java spring framework. It running on tomcat app server. Portal is served through apache web server connected to tomcat through JK connector. Entire portal is HTTPS enabled using 443 port of apache. Apache version is : Apache/2.4.2 (Unix). it is the latest stable version of apache web server.

Whenever we try to upload files more than 128 KB into the portal, We are facing 413 error:

Request Entity Too Large The requested resource /teamleadchoachingtracking/doFileUpload does not allow request data with POST requests, or the amount of data provided in the request exceeds the capacity limit.

In the apache error log we get the following errors:

AH02018: request body exceeds maximum size (131072) for SSL buffer
AH02257: could not buffer message body to allow SSL renegotiation to proceed

We did search over google and there were suggestions to put SSLRenegBufferSize as some high value like 10MB. Based on these suggestions, we had put the following entry in virtualhost section of httpd config file:

<Directory "/teamleadchoachingtracking/doFileUpload/">
SSLRenegBufferSize 10486000
</Directory>

But still the error persists. Also we have specified SSLVerifyClient none, but still renegotiation is happening.

This is a very inconsistent and frustrating error. Any help will be highly appreciated. Many thanks in advance.

  • Have you seen the bug thread on Apache bugzilla's site? There are a few other workarounds discussed that might be of use to you. issues.apache.org/bugzilla/show_bug.cgi?id=39243 – HopelessN00b Aug 21 '12 at 17:42
  • I did go through all that before posting here. Even after following those suggestions issue still persists. At the end of all these SSLRenegBufferSize param was the official fix from apache which we tried. That did not solve it. – tushar Aug 21 '12 at 18:17
11

I managed to solve it by putting certain configuration in apache httpd.conf file. Here is the sample configuration:

<Location "/calibration">
  SSLRenegBufferSize 10486000
</Location>

Earlier i was not giving correct configuration. Key is the exact URL location which is causing http 413 error. In the location directive exact URL location needs to be given. SSLRenegBufferSize is the param which specifies the max buffer size in bytes in case a renegotiation happened. I had set it to 10 MB. Apache default is 128KB.

  • After running into simillar issue, httpd.apache.org/docs/current/mod/mod_ssl.html says: by default a strict scheme is enabled where every per-directory reconfiguration of SSL parameters causes a full SSL renegotiation handshake, you can try using SSLOptions +OptRenegotiate, but SSLVerifyClient directive in .htaccess or per directory will always force renegotiation, which means setting SSLRenegBufferSize, at the end, we went with a different virtual host, which was serving the specific directory – zeldi Jan 6 '17 at 9:25
1

This problem occurs during an SSL renegotiation. In addition to setting the renegotiate buffer size on Apache to a very high number you have a few other options:

  • Configure your (virtual) host to use only a single authentication scheme to avoid renegotiation all together
  • Use a client that supports HTTP 1.1 Expect Header

See https://stackoverflow.com/questions/14281628/ssl-renegotiation-with-client-certificate-causes-server-buffer-overflow

0

As far as I've seen on my ubuntu 14.04/apache 2.4 server, assuming you're using .htaccess apache configuration, the SSLVerifyDepth parameter also triggers the SSL Renegociation even if the SSLVerifyClient is none. Using the SSLVerifyDepth configuration line will also bypass the SSLRenegBufferSize value you may had set for this directory and all subdirs.

There is something about the difference between using the SSLVerifyDepth in the per-server context and in the per-directory context in the documentation. I thus assume this problematic comportment will be the same with <directory> config lines. Once read attentively, the doc also states this parm will force the reneg...

This solution did work for me :

  • put the SSLVerifyDepth in your main ssl.conf or in your virtual host conf, SSLVerifyDepth 5 should fit a vast majority of major cert providers' cert chains.

  • put the SSLRenegBufferSize with the required size in a .htaccess or in a <directory> per-directory configuration.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.