From 5a5d3d7013dbc098a5fed9831fa443af93bdd983 Mon Sep 17 00:00:00 2001 From: Holger Weiss Date: Mon, 7 May 2012 12:11:48 +0200 Subject: Disable stateless SSL session resumption Some versions of OpenSSL fail to negotiate the SSL connection with at least some versions of Tomcat if stateless SSL session resumption support (see RFC4507) is enabled: | CRITICAL - Cannot make SSL connection | 140099330348712:error:140943F2:SSL routines:SSL3_READ_BYTES:sslv3 alert unexpected message:s3_pkt.c:1195:SSL alert number 10 The problem is reproducible with OpenSSL 1.0.0h, but not with OpenSSL 0.9.8o-4squeeze12 (as shipped with Debian 6.0.4). We work around it by disabling the RFC4507 functionality when using OpenSSL versions which support it. Thanks to Dag Bakke for reporting the issue and for giving me access to a server I could use to reproduce the problem. --- plugins/sslutils.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'plugins') diff --git a/plugins/sslutils.c b/plugins/sslutils.c index 0bc61ed3..6e86dc62 100644 --- a/plugins/sslutils.c +++ b/plugins/sslutils.c @@ -52,6 +52,9 @@ int np_net_ssl_init_with_hostname (int sd, char *host_name) { printf ("%s\n", _("CRITICAL - Cannot create SSL context.")); return STATE_CRITICAL; } +#ifdef SSL_OP_NO_TICKET + SSL_CTX_set_options(c, SSL_OP_NO_TICKET); +#endif if ((s = SSL_new (c)) != NULL){ #ifdef SSL_set_tlsext_host_name if (host_name != NULL) -- cgit v1.2.3