Re: IIS6.0 + SSL Breaks down!

From: Jportelas (Jportelas_at_discussions.microsoft.com)
Date: 02/04/05 

Date: Fri, 4 Feb 2005 05:45:01 -0800

Hi David:

Thanks for the reply and the patience.Also thanks for the explanation on the
SSL desing failure.

Well, about me saying I was using client certificates, I did it in the first
message right here as you can see down below:

"This is my environment:

Windows2003, IIS6.0, SSL + Client Certificates, .NET Fmk 1.1, All the
current Fixes released by MS."

So, me question now seems to be: how can I increase the "SSL ReadAhead"
value to make it bigger that the POST size?? Is it possible?

Thanks.

Jairo Portela.

"David Wang [Msft]" wrote:

> I still suggest you contact PSS.
>
> The 413 issue you listed is actually NOT a bug in IIS6 -- behavior is
> by-design -- the bug is actually in the SSL spec regarding client
> certificates. The bad design in the public spec is that SSL is at the TCP
> level while Client-Certificate (for authorization/authentication purposes)
> is at the HTTP level or above. Literally, IIS needs to complete SSL
> handshake before being able to decrypt the URL, only to see that Client
> Certificate settings require a re-negotiation of the SSL handshake... so
> what happens if the client already started sending a large chunk of entity
> body via POST ???
>
> If IIS accepts the POST and the client certificate handshake fails, we just
> wasted bandwidth. If IIS rejects the POST, the client is confused. To
> allow you to configure how much bandwidth you are willing to waste before
> rejecting the request, that value is tied to the UploadReadAhead value -- so
> if the entity body is > SSL ReadAhead, IIS simply rejects the POST with a
> 413; if the entity body is < SSL ReadAhead, IIS can read in the entity body
> to unblock the client prior to re-negotiating.
>
> So, IIS6 behavior is actually quite reasonable given the bogus spec
> requirement.
>
>
> You haven't stated that you are using client certificates (which is
> necessary to get into this situation), so I'm not certain you're even
> looking at the right info. If the suggested solution doesn't work for you,
> it probably is not related.
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "Jportelas" <Jportelas@discussions.microsoft.com> wrote in message
> news:2961784B-51ED-4AD8-BD3F-0608A5361815@microsoft.com...
> This is a Follow up:
>
> I was checking on the site's IIS Log and I found that the 413 - 'Request
> entity too large' shows up every time the blank page is displayed in the
> client's browser, even the client just posts a few bytes... I think this is
> related with a know bug of the IIS6 when the client can't re-negotiate the
> client certificate
> (http://www.microsoft.com/resources/documentation/iis/6/all/proddocs/en-us/q
> ss_wss_troubleshooting.mspx),
> so I tried to increase the "UploadReadAheadSize" to 500 KB (big requests is
> about 140 KB) but it still keeps displaying blank pages from time to time.
> An other thing I noticed is that when I navigate frequently (small intervals
> between click and click) the page works ok, but when I wait more than 2-3
> minutes, blank page shows up once again.
>
> Please help on this.... anyone..
>
> Thanx
>
> "Jportelas" wrote:
>
> > Hi:
> >
> > Found someone with the same problem:
> >
> > http://www.i-eye.net/archive/27889-Strange_IIS_and_SSL_problems.php
> >
> > Still nobody seems to know the answer to this problem, it seems like I'll
> > have to contact PSS and Pay to get this situation fixed.
> >
> > Oh something else on the problem, it happens with Host headers and without
> > them, so this doesn't seem to be an issue on the problem.
> >
> > Bye.
> >
> >
> > "Jportelas" wrote:
> >
> > > Hi David:
> > >
> > > thanks for the reply.
> > >
> > > Ok, I think we'll contact PSS for support in this case.
> > >
> > > About your questions:
> > >
> > > 1. What mode do you run IIS6 in -- IIS5 Compatibility or IIS6 worker
> process
> > > isolation mode : It's running in the IIS6 default, it should be IIS6
> Wp.
> > >
> > > 2. Do you run any custom ISAPI Filters (written by you or installed by
> other
> > > server apps) -- if yes, what are they, and what filter events do they
> listen
> > > to. : no, we don't. We don't have any custom ISAPI Filters, only the
> ones
> > > installed by ASP.NET 1.1.4322.
> > >
> > > 3. Are you getting blank pages on small or large SSL POST requests:
> Only in
> > > large SSL Posts David.
> > >
> > > I hope the SP1 for Windows2003 solves this, cause this never happened
> under
> > > IIS5 and Windows 2000.
> > >
> > > Thanks for the help, I really aprecciate it.
> > >
> > > Jairo Portela S.
> > >
> > >
> > > "David Wang [Msft]" wrote:
> > >
> > > > If you think you are seeing a product bug, contact Microsoft PSS for
> > > > support.
> > > > - If there is a fix, they can diagnose it and give you the QFE.
> > > > - If it is a new bug, they can diagnose it and get it into the product
> > > > team's hands for evaluation.
> > > > - If it is known, they may have work-arounds available
> > > >
> > > > I will also note that there were some fixes with SSL/Certificates that
> are
> > > > slated to release with WS03SP1 -- not certain if it fixes your
> situation.
> > > > However, due to how support works, you have to call PSS to have a
> chance to
> > > > get a QFE.
> > > >
> > > >
> > > > There are a couple of things that I must also ask:
> > > > 1. What mode do you run IIS6 in -- IIS5 Compatibility or IIS6 worker
> process
> > > > isolation mode
> > > > 2. Do you run any custom ISAPI Filters (written by you or installed by
> other
> > > > server apps) -- if yes, what are they, and what filter events do they
> listen
> > > > to.
> > > > 3. Are you getting blank pages on small or large SSL POST requests
> > > >
> > > > --
> > > > //David
> > > > IIS
> > > > http://blogs.msdn.com/David.Wang
> > > > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > > > //
> > > > "Jportelas" <Jportelas@discussions.microsoft.com> wrote in message
> > > > news:1F810F7C-DBD3-484A-9436-140DC47EBFF8@microsoft.com...
> > > > Good morning:
> > > >
> > > > This is my environment:
> > > >
> > > > Windows2003, IIS6.0, SSL + Client Certificates, .NET Fmk 1.1, All the
> > > > current Fixes released by MS.
> > > >
> > > > I have a production server that has some really big pages (lots of
> data),
> > > > from time to time (but becoming more frequent everytime) I get blank
> pages,
> > > > but requests never reach the .NET pages, the IIS replies with empty
> HTML as
> > > > the one copied at the end of this message. I was reading on a forum
> about a
> > > > similar
> > > >
> case(http://www.derkeiler.com/Newsgroups/microsoft.public.inetserver.iis.sec
> > > > urity/2003-08/0867.html),
> > > > the proposed solution is not to use 'Client Certificates', and it
> really
> > > > works!!! but I really need to use Client certificates? is there any
> way to
> > > > work around this problem? any QFE package I can get?
> > > >
> > > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> > > > <HTML><HEAD>
> > > > <META http-equiv=Content-Type content="text/html;
> > > > charset=windows-1252"></HEAD>
> > > > <BODY></BODY></HTML>
> > > >
> > > >
> > > > Thanx for any help.
> > > >
> > > >
> > > >
>
>
>

Relevant Pages

  • Re: Client Certificates - Force a fresh authentication
    ... State cache of IE seems to keep sending the same client certificate ... I can't see anything I can do server side through IIS or a framework ... The only thing I've found of use is to clear the client's SSL State ...
    (microsoft.public.inetserver.iis.security)
  • SSL and IPS (was RE: ssh and ids)
    ... How many simultaneous SSL sessions can be tracked?" ... I assume you're talking about a case in which the client constantly ... If you walk the possible session id space and ... The server chooses the session ID, ...
    (Focus-IDS)
  • Re: IIS6.0 + SSL Breaks down!
    ... Ok, I asked the IIS SSL developer, and he gave me the details. ... bad public specification on SSL make SSL Client Certificates ...
    (microsoft.public.inetserver.iis)
  • Re: Can SSL sessions be compromised?
    ... etc) attachments using webmail during these SSL sessions. ... who the client thinks the server is ... ... part of this has to do with the fundamental digital certificate and PKI ...
    (comp.security.misc)
  • Re: OpenSSL read/write timeouts
    ... This is an example of a SSL client with minimum functionality. ... This SSL client verifies the server's certificate against the ... the SSL server does not request & verify the client ...
    (comp.os.vms)