Cannot establish HTTP/2 connection from OkHTTP/ALPN/Linux client with Apache HTTP

0

Problem which I have is Linux related, as it does not occur when the same HTTP2 client runs from Windows.

$java -jar -Xbootclasspath/p:alpn-boot-8.1.9.v20160720.jar SampleOkHttp-1.0.jar https://192.168.1.10:8080/simple.html

HTTP/2 preface communication:

Windows

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS
>> 0x00000000     4 WINDOW_UPDATE
<< 0x00000000     6 SETTINGS
<< 0x00000000     4 WINDOW_UPDATE
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     0 SETTINGS      ACK
<< 0x00000003    86 HEADERS       END_HEADERS
<< 0x00000003   220 DATA          END_STREAM
h2
<< 0x00000000     8 GOAWAY

Linux

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS      
>> 0x00000000     4 WINDOW_UPDATE 
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
<< 0x00000000     6 SETTINGS      
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     8 GOAWAY        
<< 0x00000000     4 WINDOW_UPDATE 
<< 0x00000000     8 GOAWAY

Tried with Ubuntu\Fedora, from local\remote machine, with different java\alpn versions. I'm still getting GOAWAY. Why Apache in case of Linux sends GOAWAY message? How to fix it?

linux
apache
http2
okhttp3
alpn
asked on Stack Overflow Oct 14, 2016 by Michał Gawin

1 Answer

1

Problem occurred during cipher key negotiation.

Windows with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 had no issue.

Linux was rejected because tried to use TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.

I solved issue by providing acceptable cipher keys in Apache config file conf/extra/httpd-ssl.conf described here.

In short I changed default settings for SSLCipherSuite on:

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
answered on Stack Overflow Oct 17, 2016 by Michał Gawin

User contributions licensed under CC BY-SA 3.0