SSL issues with IE/PHP

Anon

Really hope someone can shed some light on this problem:

The URL of the website is www.deweys.com

Users are telling us that they navigate the site just fine, but when they hit certain pages they get server not found errors. Sometimes, when they hit 'back' or 'refresh' they can then get the page to display. These pages all happen to be served by our SSL server, so we think it is an SSL problem. The error only occurs in Internet Explorer, and the majority of the users seem to be using AOL as an ISP, but not all. We can recreate the problem, but not consistently. When I use IE 5.5 I generally have no problems, but I have gotten the error twice. When we use IE 5.0 the problem occurs often.

The microsoft support page has a case that seems to apply, the URL is :

http://support.microsoft.com/support/kb/articles/Q181/1/47.ASP?LN=EN-US&SD=gn&FR=0&qry=ssl%20error&rnk=2&src=DHCS_MSPSS_gn_SRCH&SPR=IE

My questions are:

Is there anything we can do on our end (programming or server settings), short of asking all our users to select certain settings?
Why do we experience these problems when other SSL servers do not?
What exactly do we need to tell our users to do, if that is the only option?

Other information that might be helpful:

The "shop" application is an open source solution called PHPShop (www.phpshop.org) written in php3, modified extensively by us.
The shop uses http GET and POST variables as well as cookies.
The insecure server is Apache1.3.9 , the secure server is Apache1.3.12, the OS is RedHat Linux 6.1
The secure server uses mod_ssl which is based on OpenSSL.

Thanks again for your help; any suggestions you have will be greatly appreciated.

Brant

Anon

Hi,

We also get Error messages when using ssl with php and IE. I have not been able to reproduce the error message myself but others get it sporadically and intermittently. Maybe we can trade notes or something.

Just email me at jphilapy@yahoo.com

Anon

I am experiencing this same problem with a PHP shopping cart that I wrote. I have the ability to reproduce the problem at least, so I can troubleshoot. Problem is, none of the 10 things I've tried has worked. This problem was noted on the php.net bug-report site once, and the Zend folks said it wasn't php, but probably the poster's system environment.

It is happening only under SSL, so that is one thing to consider.

I have even tried using .html as my php suffix and adjusting .htaccess accordingly. I thought maybe microsoft was just trying to mess with php folks. But that did not help either.

If anyone has any light to shed on this very real problem, it would be helpful. Any site running PHP for secure commerce is likely facing this right now and if not, it is probably only because the customers running IE are just leaving your site behind.

-Barlow

Anon

We were able to solve our problem by forcing non SSL3 mode using the following directive in the httpd.conf file:

SSLProtocol all -SSLv3

This allows all versions except SSLv3. This seems to have fixed our problem. Let me know if this works for you.

My thanks to Andrew Dean for providing the ultimate solution!

Brant

Anon

My site is on a sharind hosting account so is there any other solution, that we give the same directive in PHP pages?

Regards

Tahir

Anon

I have a solution and you will be able to fix it with just a little change in PHP file. But I will charge for this. Please contact me.

http://www.sulata.com.pk/sslproblem.

Anon

There is a solution at http://www.sulata.com.pk/sslproblem

Anon

I don't how to feel about this guy charging for the solution to a problem that is well known. If you go to modssl.org and look at their frequently asked questions area, you will find all you need to know to fix the problem. Usually you can put the proper apache directives into your .htaccess file, but if you have your own server with root access, all the easier.

In your .htaccess file, try this directive:

SetEnvIf User-Agent ".MSIE." \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

And then try this one as well:

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

(that's all one line).

I did the above in my virtual hosts file for the account, and it worked great; no more problems. I have not tried it in a .htaccess file, but I'm sure it would fix it.

In your httpd.conf you can also simply turn off the option of using SSLv3, but that is a rather radical approach to the problem and I don't think it actually worked as well as the above two directives.

If you want a virtual hosting account that already has these fixes in place, feel free to contact me (jon@barlownet.com) and I can send you my prices. But this information is widely known and I feel bad that folks are shelling out 200 bucks for it when you can get it off of modssl.org for free.

-Jonathan

Anon

But where to put htaccess file. In the root or in any other directory. Thanks

Anon

As for where you put your .htaccess file, just refer to the general rules for these. (They go along with the apache web server). You can find documentation at apache.org.

Anon

the above have been set inside my httpd.conf file, but it still can't work. Pls help