Re: AW: [users@httpd] Incompatibility Apache reverse proxy and Internet Explorer?

[Christian Gottschalch <masro@xxxxxxx>]

using ssl in backend may be not a good idea, because it slows down 
everything,

try
BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown
or
BrowserMatch ".*MSIE.*" ssl-unclean-shutdown


Kirchel Oliver schrieb:
> Hi,
> I think we had the same error. 
>
> "The DMZ1 proxy is connected via ssl, the other connections are plain http."
>
> Try to connect "the other connection" via ssl, too.
>
> That was our solution.
>
> Greetings 
>
> Olli
>
> -----Ursprüngliche Nachricht-----
> Von: Spil Oss [mailto:spil.oss@xxxxxxxxxxxxxx] 
> Gesendet: Dienstag, 14. November 2006 13:22
> An: users@xxxxxxxxxxxxxxxx
> Betreff: [users@httpd] Incompatibility Apache reverse proxy and Internet Explorer?
>
> Hi all,
>
> Spuriously we get "Server not found or DNS Error" in Internet Explorer
> for a site that is reversed proxied with Apache.
> Please find a txt export of the pcap dump attached.
>
> What seems to happen is that the reverse proxy returns FIN, ACK on the
> 3 connections from IE and subsequently a RST. This then triggers IE
> into displaying the "Server not found or DNS Error" message.
> Disabling "Show friendly HTTP error messages" seems to help, but we
> can't force "the whole world" to change that setting in their Internet
> Explorer browser (if that were possible for users in a business
> environment anyway)
>
> The setup:
> Internet Explorer ->
> Reverse Proxy DMZ1 ->
> Reverse Proxy DMZ2 ->
> Application Server
> v.v.
>
> The reverse proxies have simple proxy rules like
> ProxyPass /b2b_portal/ http://dmz2web.domain.com:8080/b2b_portal/
> <Location /b2b_portal/>
>    ProxyPassReverse /b2b_portal/
> </Location>
>
> and on dmz2web
> ProxyPass /b2b_portal/ http://app1.domain.com:80/b2b_portal/
> <Location /b2b_portal/>
>    ProxyPassReverse /b2b_portal/
> </Location>
>
> The DMZ1 proxy is connected via ssl, the other connections are plain http.
>
> Anyone experience this before and/or can explain this behaviour of the
> apache reverse proxy? (2.2.3-ssl running on Windows 2003)
>
> PS. We used IIS as reverse proxy before and that was fine.....
> PS. No such behaviour using Firefox 1.5/2.0
>
> Help is very much appreciated!
>
> Kind regards,
>
> Spil.
>
> D:\Apache2.2>bin\httpd.exe -V
> Server version: Apache/2.2.3
> Server built: Aug 10 2006 17:29:16
> Server's Module Magic Number: 20051115:3
> Server loaded: APR 1.2.7, APR-Util 1.2.7
> Compiled using: APR 1.2.7, APR-Util 1.2.7
> Architecture: 32-bit
> Server MPM: WinNT
> threaded: yes (fixed thread count)
> forked: no
> Server compiled with....
> -D APACHE_MPM_DIR="server/mpm/winnt"
> -D APR_HAS_SENDFILE
> -D APR_HAS_MMAP
> -D APR_HAS_OTHER_CHILD
> -D AP_HAVE_RELIABLE_PIPED_LOGS
> -D DYNAMIC_MODULE_LIMIT=128
> -D HTTPD_ROOT="/apache"
> -D SUEXEC_BIN="/apache/bin/suexec"
> -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
> -D DEFAULT_ERRORLOG="logs/error.log"
> -D AP_TYPES_CONFIG_FILE="conf/mime.types"
> -D SERVER_CONFIG_FILE="conf/httpd.conf"
>
> D:\Apache2.2>bin\httpd.exe -M
> Loaded Modules:
> core_module (static)
> win32_module (static)
> mpm_winnt_module (static)
> http_module (static)
> so_module (static)
> actions_module (shared)
> alias_module (shared)
> asis_module (shared)
> auth_basic_module (shared)
> authn_default_module (shared)
> authn_file_module (shared)
> authz_default_module (shared)
> authz_groupfile_module (shared)
> authz_host_module (shared)
> authz_user_module (shared)
> autoindex_module (shared)
> cgi_module (shared)
> dir_module (shared)
> env_module (shared)
> imagemap_module (shared)
> include_module (shared)
> isapi_module (shared)
> log_config_module (shared)
> mime_module (shared)
> proxy_module (shared)
> proxy_connect_module (shared)
> proxy_http_module (shared)
> negotiation_module (shared)
> rewrite_module (shared)
> setenvif_module (shared)
> userdir_module (shared)
> ssl_module (shared)
> Syntax OK
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
>    "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
> For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
>
>   


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx