7

We have a web portal setup on Java spring framework.

It is running on an Apache Tomcat app server. Portal is served through Apache web server connected to Tomcat through JK connector. Entire portal is HTTPS enabled using 443 port of apache. Apache version is: Apache/2.4.2 (Unix) which is the latest stable version of Apache web server as of this posting.

Whenever we try to upload files more than 128KB into the portal, We are facing 413 error:

Request Entity Too Large The requested resource /teamleadchoachingtracking/doFileUpload does not allow request data with POST requests, or the amount of data provided in the request exceeds the capacity limit.

In the apache error log we get the following errors:

AH02018: request body exceeds maximum size (131072) for SSL buffer
AH02257: could not buffer message body to allow SSL renegotiation to proceed

We did a Google search and there were suggestions to put SSLRenegBufferSize as some high value like 10MB. Based on these suggestions, we had put the following entry in virtualhost section of httpd config file:

<Directory "/teamleadchoachingtracking/doFileUpload/">
SSLRenegBufferSize 10486000
</Directory>

But still the error persists.

Also we have specified SSLVerifyClient none, but still renegotiation is happening.

This is a very inconsistent and frustrating error. Any help will be highly appreciated. Many thanks in advance.

Improve this question
2
  • Have you seen the bug thread on Apache bugzilla's site? There are a few other workarounds discussed that might be of use to you. issues.apache.org/bugzilla/show_bug.cgi?id=39243
    – HopelessN00b
    Aug 21, 2012 at 17:42
  • I did go through all that before posting here. Even after following those suggestions issue still persists. At the end of all these SSLRenegBufferSize param was the official fix from apache which we tried. That did not solve it.
    – webstat
    Aug 21, 2012 at 18:17

3 Answers 3

Reset to default
16

I managed to solve it by putting certain configuration in the Apache httpd.conf file. Here is the sample configuration:

<Location "/calibration">
  SSLRenegBufferSize 10486000
</Location>

Earlier I was not giving correct configuration. The key is the exact URL location which is causing HTTP 413 error. In the location directive exact URL location needs to be given.

SSLRenegBufferSize is the param which specifies the max buffer size in bytes in case a renegotiation happened. I set it to 10 MB. Apache default is 128KB.

Improve this answer
2
  • After running into simillar issue, httpd.apache.org/docs/current/mod/mod_ssl.html says: by default a strict scheme is enabled where every per-directory reconfiguration of SSL parameters causes a full SSL renegotiation handshake, you can try using SSLOptions +OptRenegotiate, but SSLVerifyClient directive in .htaccess or per directory will always force renegotiation, which means setting SSLRenegBufferSize, at the end, we went with a different virtual host, which was serving the specific directory
    – zeldi
    Jan 6, 2017 at 9:25
  • Actually you can use <Location "/"> or <Location /> to apply the setting to whole server (or whole VirtualHost).
    – Nux
    Oct 8, 2020 at 12:43
2

This problem occurs during an SSL renegotiation. In addition to setting the renegotiate buffer size on Apache to a very high number you have a few other options:

  • Configure your (virtual) host to use only a single authentication scheme to avoid renegotiation all together
  • Use a client that supports HTTP 1.1 Expect Header

See https://stackoverflow.com/questions/14281628/ssl-renegotiation-with-client-certificate-causes-server-buffer-overflow

Improve this answer
1

As far as I've seen on my ubuntu 14.04/apache 2.4 server, assuming you're using .htaccess apache configuration, the SSLVerifyDepth parameter also triggers the SSL Renegociation even if the SSLVerifyClient is none. Using the SSLVerifyDepth configuration line will also bypass the SSLRenegBufferSize value you may had set for this directory and all subdirs.

There is something about the difference between using the SSLVerifyDepth in the per-server context and in the per-directory context in the documentation. I thus assume this problematic comportment will be the same with <directory> config lines. Once read attentively, the doc also states this parm will force the reneg...

This solution did work for me :

  • put the SSLVerifyDepth in your main ssl.conf or in your virtual host conf, SSLVerifyDepth 5 should fit a vast majority of major cert providers' cert chains.

  • put the SSLRenegBufferSize with the required size in a .htaccess or in a <directory> per-directory configuration.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.