Why would TLS version in one config cause another to break?

DevOpsSauce

12/25/22, 2:20 AM

I have an Apache proxy that has several VHosts. Some of these are legacy configs that were before my time. Long story short, I removed some .crt files on the server that had expired, and forgot to remove the associated /etc/apache2/ssl/*.conf files, so when Apache would try to rotate its logs, it would fail.

After repairing that mess, I began receiving 502 Proxy Error when navigating to only one of the VHosts. All the others worked.

This is what was causing everything to break. In one of the /etc/apache2/sites-enabled/*.conf files, there was this line:

SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
#SSLProxyProtocol +TLSv1 <---- THIS BROKE IT

All the other VHosts are using TLSv1.2. My question is, why would this make only ONE VHost break and not all of them, especially when it wasn't even the config that had the old TLS in the file?

Update I set Apache's log level to debug, and it shows the error, but doesn't tell me which config file was the culprit. Luckily, I know which one:

[Mon Aug 30 08:26:35.098657 2021] [ssl:info] [pid 10843] SSL Library Error: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version (SSL alert number 70)
[Mon Aug 30 08:26:35.098679 2021] [ssl:info] [pid 10843] [remote 192.168.66.120:8004] AH01998: Connection closed to child 0 with abortive shutdown (server www.example.com:443)
[Mon Aug 30 08:26:35.098715 2021] [ssl:info] [pid 10843] [remote 192.168.66.120:8004] AH01997: SSL handshake failed: sending 502

0 + 0

ubuntu

ssl

proxy

502

apache-2.4

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why would TLS version in one config cause another to break?

TH: เหตุใดเวอร์ชัน TLS ในการกำหนดค่าหนึ่งจึงทำให้อีกเวอร์ชันหนึ่งเสียหาย

RO: De ce versiunea TLS într-o configurație ar provoca rupea alta?

RU: Почему версия TLS в одной конфигурации может привести к поломке другой?

VI: Tại sao phiên bản TLS trong một cấu hình lại khiến một cấu hình khác bị hỏng?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.