<div dir="ltr">Hi Rob,<div><br></div><div>Thanks for your reply yesterday. Here is my problem. We are using mod_nss version 1.0.8 on RHEL6. Here is a session that our F5 admin sent to our production webserver at the command line using openssl.</div><div><br></div><div><div># openssl s_client -connect x.x.x.x:443 < /dev/null</div><div><br></div><div><br></div><div><br></div><div>CONNECTED(00000003)</div><div>depth=2 C = US, O = U.S. Government, OU = DoD, OU = PKI, CN = DoD Root CA 2</div><div>verify error:num=19:self signed certificate in certificate chain</div><div>verify return:0</div><div>---</div><div>Certificate chain</div><div> 0 s:/C=us/O=u.s. government/OU=DOD/OU=pki/OU=disa/CN=<a href="http://metadata.ces.mil">metadata.ces.mil</a></div><div> i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD CA-28</div><div> 1 s:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD CA-28</div><div> i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2</div><div> 2 s:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2</div><div> i:/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DoD Root CA 2</div><div>---</div><div>Server certificate</div><div>-----BEGIN CERTIFICATE-----</div><div>MIIFczCCBFugAwIBAgIDAMDoMA0GCSqGSIb3DQEBBQUAMFcxCzAJBgNVBAYTAlVT</div><div>MRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsTA0RvRDEMMAoGA1UE</div><div>CxMDUEtJMRIwEAYDVQQDEwlET0QgQ0EtMjgwHhcNMTMxMTAxMjExMTM0WhcNMTYx</div><div>MTAxMjExMTM0WjBtMQswCQYDVQQGEwJ1czEYMBYGA1UEChMPdS5zLiBnb3Zlcm5t</div><div>ZW50MQwwCgYDVQQLEwNET0QxDDAKBgNVBAsTA3BraTENMAsGA1UECxMEZGlzYTEZ</div><div>MBcGA1UEAxMQbWV0YWRhdGEuY2VzLm1pbDCCASIwDQYJKoZIhvcNAQEBBQADggEP</div><div>ADCCAQoCggEBAMuaXfCzffQnuqtQAwwTssjkbHEpQICFsjD5T0BhhLYwf/6MEZIe</div><div>Dfx97j7CvqthxvVEtVe6j5d99OXW0rrXowgo/bGhnc8pR5sDke2hlUbmjb+XkqZR</div><div>03QyKv2+DFhiv8BIlO8EAygQZSYK8lyKxvvEwI19RRht1uZ9Mcn2hUKlm7OD6nnH</div><div>grCk+qo8idCE2qO52gln46Q12nHIEHIrc8u6+EcgrdbC/Tpj5G+0HTuzOw4aQ0H8</div><div>EMLQk8e7EdubfOxdhscS2YQtzNBkvLVEgA8QZr2wMleYG2ZJDRB0W5m6n12/3lpv</div><div>M+hZMAJO8pDrzzmM1OZ0ZZYTsd2i9pvUNAsCAwEAAaOCAjAwggIsMB8GA1UdIwQY</div><div>MBaAFCa0rqotjumNim+2tVud6k6usZxpMB0GA1UdDgQWBBRKkMaGpVHBLnDcBRcL</div><div>SdbKrPieKjBjBggrBgEFBQcBAQRXMFUwMQYIKwYBBQUHMAKGJWh0dHA6Ly9jcmwu</div><div>ZGlzYS5taWwvc2lnbi9ET0RDQV8yOC5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9v</div><div>Y3NwLmRpc2EubWlsMA4GA1UdDwEB/wQEAwIFoDCBwwYDVR0fBIG7MIG4MCqgKKAm</div><div>hiRodHRwOi8vY3JsLmRpc2EubWlsL2NybC9ET0RDQV8yOC5jcmwwgYmggYaggYOG</div><div>gYBsZGFwOi8vY3JsLmdkcy5kaXNhLm1pbC9jbiUzZERPRCUyMENBLTI4JTJjb3Ul</div><div>M2RQS0klMmNvdSUzZERvRCUyY28lM2RVLlMuJTIwR292ZXJubWVudCUyY2MlM2RV</div><div>Uz9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0O2JpbmFyeTBbBgNVHREEVDBSghBt</div><div>ZXRhZGF0YS5jZXMubWlsghBtZXRhZGF0YS5jZXMubWlsghVtZXRhZGF0YS1jb2xz</div><div>LmNlcy5taWyCFW1ldGFkYXRhLXNhdHguY2VzLm1pbDAjBgNVHSAEHDAaMAsGCWCG</div><div>SAFlAgELBTALBglghkgBZQIBCxIwLQYDVR0lBCYwJAYIKwYBBQUHAwEGCCsGAQUF</div><div>BwMCBggrBgEFBQgCAgYEVR0lADANBgkqhkiG9w0BAQUFAAOCAQEAjVht0bS/D5+M</div><div>kCoYbxyFLWnAIWzoeyZC2al5znPllgQrW+RTVBjGiYlvKB2W5eXVJF+RCjCBk1k5</div><div>qrtINH39+FQQZjivwhidLKWklEUt4MRN3tulRlTj+Hr34F0reD56EQaFSlXXvY0r</div><div>+LNx5xzudvvrf45dCbHKGNmjDpyDIiezJbCojfYfN7E8ljkA0bq5Ku4eCsAm4sbd</div><div>ezRoZsxSzzOUuynmP3yo20A+nU6+dDsVPXulkamlLGpVnC7nHnl5f8gspr4S7Ld8</div><div>MnC/K7qfNaUTUkpe7Qym8WfKU0dUHWNAzqvSmhYJlk7wYwpKRfRlPi2cxabOkcxL</div><div>4F2HMSAkIw==</div><div>-----END CERTIFICATE-----</div><div>subject=/C=us/O=u.s. government/OU=DOD/OU=pki/OU=disa/CN=<a href="http://metadata.ces.mil">metadata.ces.mil</a></div><div>issuer=/C=US/O=U.S. Government/OU=DoD/OU=PKI/CN=DOD CA-28</div><div>---</div><div>No client certificate CA names sent</div><div>---</div><div>SSL handshake has read 3989 bytes and written 647 bytes</div><div>---</div><div>New, TLSv1/SSLv3, Cipher is AES256-SHA</div><div>Server public key is 2048 bit</div><div>Secure Renegotiation IS supported</div><div>Compression: NONE</div><div>Expansion: NONE</div><div>SSL-Session:</div><div> Protocol : TLSv1.1</div><div> Cipher : AES256-SHA</div><div> Session-ID: 606DF4ED165AF725E18F3EBAA3BE18669E7E47921BF246EF1851C6E622C15B2A</div><div> Session-ID-ctx:</div><div> Master-Key: A7F149F1EFF32EC29C8C1F570A076A7F3A20C7890F58958A9539ECC52822E28BCBBC94949C638AF52D8D89854887018C</div><div> Key-Arg : None</div><div> PSK identity: None</div><div> PSK identity hint: None</div><div> TLS session ticket lifetime hint: 172800 (seconds)</div><div> TLS session ticket:</div><div> 0000 - 4e 53 53 21 d9 f3 55 ff-e1 a9 5e a1 bb 2c 45 50 NSS!..U...^..,EP</div><div> 0010 - 27 9c cc 9d 07 2a af 5f-a3 06 ad 26 9a 1d cc 7a '....*._...&...z</div><div> 0020 - 00 50 e7 85 b2 eb 32 7f-dc 71 d3 ec 39 09 43 8a .P....2..q..9.C.</div><div> 0030 - 08 40 6c 6f b5 9e df 9c-4b 57 78 49 50 af d4 9b .@lo....KWxIP...</div><div> 0040 - 84 83 3d 8d de c8 91 6f-2c 9c 83 a4 bc 9c 68 4a ..=....o,.....hJ</div><div> 0050 - b1 4f 46 1e fb a9 80 3f-f6 ff f7 3a 4f b3 e7 5a .OF....?...:O..Z</div><div> 0060 - 8f 69 a2 3e 8a 57 d5 53-18 b2 15 bf 72 86 e1 d9 .i.>.W.S....r...</div><div> 0070 - 9d b5 3e 1e 45 80 d6 96-e3 b7 c5 ca b4 03 d3 21 ..>.E..........!</div><div> 0080 - 70 95 a7 77 32 9e 92 7b-bf bb 4d b2 92 3f 8f 61 p..w2..{..M..?.a</div><div> 0090 - 03 dd ..</div><div><br></div><div> Start Time: 1444922629</div><div> Timeout : 300 (sec)</div><div> Verify return code: 19 (self signed certificate in certificate chain)</div><div>---</div><div>DONE</div></div><div><br></div><div>As you can see, our server is clearing presenting a TLS session ticket which supposedly should be turned off by default in this version of mod_nss. I'm confused, and I'm also a newbie to mod_nss. Could you please help me understand?</div><div><br></div><div>Thanks,</div><div><br></div><div>Larry Cohen</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 14, 2015 at 11:26 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Cohen, Laurence wrote:<br>
> I'm trying to find out what version of mod_nss uses TLSSESSIONTICKETS<br>
> and has the ability to turn them off. I see that Fedora has a version<br>
> that has this function, but I need this function for RHEL6. I want to<br>
> try to avoid doing a custom build since this is for a government customer.<br>
<br>
</span>TLS Session tickets are disabled by default. mod_nss 1.0.12 adds an<br>
option to turn them on.<br>
<span class="HOEnZb"><font color="#888888"><br>
rob<br>
<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.5;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);font-family:Helvetica,sans-serif;font-size:15px;vertical-align:baseline;white-space:pre-wrap;background-color:transparent"><img alt="www.novetta.com" src="https://p2.zdassets.com/hc/theme_assets/236109/200035260/novetta-email.png" style="border:currentcolor" height="56" width="211"></span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.5;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,100,182);font-family:Helvetica,sans-serif;font-weight:bold;vertical-align:baseline;white-space:pre-wrap">Larry Cohen</span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;font-style:italic;vertical-align:baseline;white-space:pre-wrap">System Administrator</span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.5;margin-top:0pt;margin-bottom:0pt"><br style="font-size:13.3333339691162px;line-height:22.2222232818604px"></p><p style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap">12021 Sunset Hills Road, Suite 400</span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap">Reston, VA 20190</span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,100,182);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap">Email</span><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap"> lcohen@</span><span style="color:rgb(17,85,204);font-family:Helvetica,sans-serif;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap"><a href="http://novetta.com" target="_blank">novetta.com</a></span><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap"> </span></p><p dir="ltr" style="color:rgb(51,51,51);font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,100,182);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap">Office</span><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap"> 703-885-1064</span></p><p dir="ltr" style="font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333339691162px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap"></span></p><table style="color:rgb(147,149,152);font-family:sans-serif;font-size:medium"><tbody><tr></tr><tr></tr><tr></tr></tbody></table> </div></div>
</div>