<div dir="ltr"><span style="font-size:12.8000001907349px">I am running httpd-2.4.12 and mod_nss-1.0.11 built from source and am running into an issue where I occasionally get an error where mod_nss throws the following exception</span><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up.</div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">What is strange is that the issue does not happen consistently, sometimes the error will occur after the first request, other times after the 5000th. </div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">Any thoughts about what could be causing this?</div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">The following is what I'm seeing in the log</div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px"><div>[Wed Apr 08 18:31:07.331041 2015] [:info] [pid 17342:tid 47143550196032] Connection to child 0 established (server <a href="http://test.domain.com:443/" target="_blank">test.domain.com:443</a>, client 10.81.1.91)</div><div>[Wed Apr 08 18:31:07.412436 2015] [:info] [pid 17342:tid 47143550196032] Initial (No.1) HTTPS request received for child 0 (server <a href="http://test.domain.com:443/" target="_blank">test.domain.com:443</a>)</div><div>[Wed Apr 08 18:31:07.412499 2015] [authz_core:debug] [pid 17342:tid 47143550196032] mod_authz_core.c(835): [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH01628: authorization result: granted (no directives)</div><div>[Wed Apr 08 18:31:07.412654 2015] [proxy:debug] [pid 17342:tid 47143550196032] mod_proxy.c(1163): [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH01143: Running scheme https handler (attempt 0)</div><div>[Wed Apr 08 18:31:07.412669 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2140): AH00942: HTTPS: has acquired connection for (<a href="http://test.domain.com/" target="_blank">test.domain.com</a>)</div><div>[Wed Apr 08 18:31:07.412734 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2193): [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH00944: connecting<a href="https://test.domain.com:8443/test/home.html" target="_blank">https://test.domain.com:8443/test/home.html</a> to <a href="http://test.domain.com:8443/" target="_blank">test.domain.com:8443</a></div><div>[Wed Apr 08 18:31:07.412745 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2394): [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH00947: connected /test/home.html to<a href="http://test.domain.com:8443/" target="_blank">test.domain.com:8443</a></div><div>[Wed Apr 08 18:31:07.412752 2015] [:debug] [pid 17342:tid 47143550196032] nss_engine_io.c(658): SSL connection destroyed without being closed</div><div>[Wed Apr 08 18:31:07.412859 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2636): AH00951: HTTPS: backend socket is disconnected.</div><div>[Wed Apr 08 18:31:07.412910 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2771): AH02824: HTTPS: connection established with <a href="http://10.81.1.183:8443/" target="_blank">10.81.1.183:8443</a>(<a href="http://test.domain.com/" target="_blank">test.domain.com</a>)</div><div>[Wed Apr 08 18:31:07.412923 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2923): AH00962: HTTPS: connection complete to <a href="http://10.81.1.183:8443/" target="_blank">10.81.1.183:8443</a>(<a href="http://test.domain.com/" target="_blank">test.domain.com</a>)</div><div>[Wed Apr 08 18:31:07.412928 2015] [:info] [pid 17342:tid 47143550196032] Connection to child 0 established (server <a href="http://test.domain.com:443/" target="_blank">test.domain.com:443</a>, client 10.81.1.183)</div><div>[Wed Apr 08 18:31:07.424280 2015] [:error] [pid 17342:tid 47143550196032] SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up.</div><div>[Wed Apr 08 18:31:07.424330 2015] [:info] [pid 17342:tid 47143550196032] SSL library error -12276 writing data</div><div>[Wed Apr 08 18:31:07.424337 2015] [:info] [pid 17342:tid 47143550196032] SSL Library Error: -12276 Requested domain name does not match the server's certificate</div><div>[Wed Apr 08 18:31:07.424344 2015] [proxy:error] [pid 17342:tid 47143550196032] (20014)Internal error: [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH01084: pass request body failed to<a href="http://10.81.1.183:8443/" target="_blank">10.81.1.183:8443</a> (<a href="http://test.domain.com/" target="_blank">test.domain.com</a>)</div><div>[Wed Apr 08 18:31:07.424352 2015] [proxy_http:error] [pid 17342:tid 47143550196032] [client <a href="http://10.81.1.91:50727/" target="_blank">10.81.1.91:50727</a>] AH01097: pass request body failed to <a href="http://10.81.1.183:8443/" target="_blank">10.81.1.183:8443</a>(<a href="http://test.domain.com/" target="_blank">test.domain.com</a>) from 10.81.1.91 ()</div><div>[Wed Apr 08 18:31:07.424356 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2155): AH00943: HTTPS: has released connection for (<a href="http://test.domain.com/" target="_blank">test.domain.com</a>)</div><div>[Wed Apr 08 18:31:07.424385 2015] [:info] [pid 17342:tid 47143550196032] Connection to child 0 closed (server <a href="http://test.domain.com:443/" target="_blank">test.domain.com:443</a>, client 10.81.1.183)</div><div>[Wed Apr 08 18:31:07.424394 2015] [proxy:debug] [pid 17342:tid 47143550196032] proxy_util.c(2864): [remote <a href="http://10.81.1.183:8443/" target="_blank">10.81.1.183:8443</a>] AH02642: proxy: connection shutdown</div><div>[Wed Apr 08 18:31:07.424686 2015] [:info] [pid 17342:tid 47143550196032] Connection to child 0 closed (server <a href="http://test.domain.com:443/" target="_blank">test.domain.com:443</a>, client 10.81.1.91)</div></div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px"><br></div><div style="font-size:12.8000001907349px">My configuration is as follows for the virtual host</div><div style="font-size:12.8000001907349px"><br></div><p style="font-size:12.8000001907349px"><VirtualHost _default_:443></p><p style="font-size:12.8000001907349px"> ErrorLog /var/log/httpd/error_log</p><p style="font-size:12.8000001907349px"> TransferLog /var/log/httpd/access_log</p><p style="font-size:12.8000001907349px"> LogLevel debug</p><p style="font-size:12.8000001907349px"> NSSEngine on</p><p style="font-size:12.8000001907349px"> NSSCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA</p><p style="font-size:12.8000001907349px"> NSSProtocol TLSv1.0,TLSv1.1,TLSv1.2<br></p><p style="font-size:12.8000001907349px"> NSSNickname "*.<a href="http://domain.com/" target="_blank">domain.com</a>"<br></p><p style="font-size:12.8000001907349px"> NSSCertificateDatabase /etc/httpd/wildcard </p><p style="font-size:12.8000001907349px"> NSSVerifyClient optional</p><p style="font-size:12.8000001907349px"> NSSOptions +ExportCertData +StdEnvVars<br></p><p style="font-size:12.8000001907349px"> <Files ~ "\.(cgi|shtml|phtml|php3?)$"></p><p style="font-size:12.8000001907349px"> NSSOptions +StdEnvVars</p><p style="font-size:12.8000001907349px"> </Files></p><p style="font-size:12.8000001907349px"> <Directory "/var/www/cgi-bin"></p><p style="font-size:12.8000001907349px"> NSSOptions +StdEnvVars </p><p style="font-size:12.8000001907349px"> </Directory></p><p style="font-size:12.8000001907349px"> ServerName <a href="http://test.domain.com/" target="_blank">test.domain.com</a><br></p><p style="font-size:12.8000001907349px"> NSSProxyEngine on</p><p style="font-size:12.8000001907349px"> NSSProxyProtocol TLSv1.0,TLSv1.1,TLSv1.2</p><p style="font-size:12.8000001907349px"> NSSProxyCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA</p><p style="font-size:12.8000001907349px"> ProxyRequests off<br></p><p style="font-size:12.8000001907349px"> ProxyPass /test <a href="https://test.domain.com:8443/test" target="_blank">https://test.domain.com:8443/test</a></p><p style="font-size:12.8000001907349px"> ProxyPassReverse /test <a href="https://test.domain.com:8443/test" target="_blank">https://test.domain.com:8443/test</a></p><p style="font-size:12.8000001907349px"></VirtualHost> </p></div>