SSL: SECURE SERVER: ERROR ON IE 5+ MAC

[jbnova]

I've been going back and forth with Gator Support for several days now with NO solutions, so I'm posting this to the forum to see if anyone else is having this problem and whether or not I can get some kind of solution without switching hosting providers. This is the first problem I've had with Host Gator and don't really want to leave over something as stupid as this.

Basically, I can't access SSL pages using Internet Explorer 5+ for Mac OS 9x. It will usually access the page on the first try of a session, but it shows the page with red X's in place of all the images. Any further attempts to access a SSL page result in the following message "Security Failure: Data Decryption Error" and the page can't be accessed. I get this result if I access the secure server through my site https://www.sterlingsecure.com/~puri...te_account.php or if I access the Host Gator SSL directly at https://www.sterlingsecure.com.

I did some research on the subject and found that it happens with other sites (and also happens in OS X), and their solution was to post a notice telling Mac users to use another browser like Netscape. That's a lame solution!!! The SSL should work for everyone...most others do! The Plesk website published some solutions which made adjustments to the server itself and fixed the problem. Here's something they suggested:

What is causing the problem?
As far as I have gathered, Mac IE 5 has a buggy implementation of SSLv3. I don't know the source of the problem, but the general fix is modifying your server to fall back on SSLv2 when it encounters this particular browser as well as enabling Session Caching. It seems that Mac IE 5 may require Session Caching to work properly even though this is in no way part of the standard.

How do I fix it?
There are two modifications to your httpd.conf file you will want to try.
The first makes Apache fall back on SSLv2 if it finds Mac IE 5. The
configuration directives below should accomplish this.

SSLProtocol all -SSLv3
SSLCipherSuite
!EXP1024-RC4-SHA:!EXP1024-DES-CBC-SHA:ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:
+LOW:+SSLv2:+EXP:+eNULL

If this is implemented and IE 5 is still receiving the error, you should add
the following:

#Inter Process Session Cache
SSLSessionCache shm:ssl_scache(512000)
#SSLSessionCache dbm:/etc/httpd/logs/ssl_cache
SSLSessionCacheTimeout 300

If this results in an error about shared memory, comment out the shm: line
and uncomment the dbm: line. ('#' starts a comment). You will know you need
the second modification if one request on your secure server loads, but no
others do. Since there is no session caching, IE 5 expects the same Session
to be used but the server is not maintaining any sessioning.

If you still have questions, feel free to contact me.

References
http://www.mail-archive.com/modssl-u...msg10339.html: The best solution I have found.
http://www.modssl.org/docs/2.8/ssl_faq.html#ToC49: A note about some
browsers requiring session caching turned on.
http://www.modssl.org/docs/2.8/ssl_reference.html#ToC5: More information about the mod_ssl directives.

Document Last Updated: April 29th, 2002

The SSL pages used to work fine on the Mac when I first set the site up a couple of months ago, so it seems like Host Gator should be able to get it working again. If you can't, please atleast SUGGEST A SOLUTION. Maybe I should host the secure pages somewhere else, but then I can never use a SSL with a domain matching a site that's hosted with Host Gator.

Many of the people I know are Mac users, so this is an important problem that I really need resolved.

Thanks for the help.

[GatorBrent]

We've been looking for someone to test it out for us that had a mac. After failing to find anyone we gave up and sent one of our employees to the local mac store at Town Center mall In fl.

They first went to https://www.sterlingsecure.com using safari (what most mac users use) It loaded fine.

We then instructed them to open up IE on the mac and try and reproduce the error you get. All the macs in the store ran 5.2.3 IE she then went to https://www.sterlingsecure.com again using IE 5.2.3 and the cert again loaded without any problems.

There's nothing we can do to fix something that is already working. If it use to work for you and now all of a sudden it no longer works the problem is on your end. SSL certs don't work with 100% of browsers but we did test what you said it wasn't working on and it did in fact work.

I'm sorry but we aren't going to be able to help you any further on this matter.

[angeleyz]

Honestly, it really does sound like a problem on your end. I've used and worked on Macs for years, so I have some ground to say this. Mac is imfamous for incompatibility issues -- most mac users are quite used to it and just say oh well. If a website doesn't work, they'll usually just try a different browser without a second thought. Yeah, Netscape (Netscrape ) sucks, but sometimes when it comes to mac, it will load sites that IE or other browsers won't. The reverse is also often true.

If it worked before then suddenly stopped working, chances are one of your settings got changed in your browser. I would highly suggest (if you haven't done so already) to go through all your browser and internet settings with a fine toothed comb.

A large majority of the time, inability to access a website is due to user error. For instance, my website -- people are always messaging me complaining they can't log in or stay logged in. That's a cookie error -- they need to adjust their settings.

Good luck and I hope you can get it figured out!

[jbnova]

I really appreciate your help with this and I'm sorry for going 'round and 'round, but I really need some kind of solution.

It's not just me that's having the problem. I've had friends in other states give it a try too. The problem exists for anyone using IE 5.0-5.1.7. The page will usually load the first time in a session, but it won't load images. Anytime after that, you get the "security failure" warning. Version 5.1.7 is the last version they made for Mac OS 9.x. They probably fixed the bug in version 5.2.3 for Mac OS X.

What bothers me is that anyone who is still using OS 9.x is probably using the buggy version of IE.

The problem occurs for any link on the https://www.sterlingsecure.com/ site. For example https://www.sterlingsecure.com/~jbnova, https://www.sterlingsecure.com/~puri...te_account.php or https://www.sterlingsecure.com/~mainst.

IT DOESN'T OCCUR if I log onto https://secure.hostgator.com/order/. So what's different about that server?! Can you get me onto a different server that works with IE 5.0-5.1.7 for Mac users that haven't upgraded to OS X? I realize that may be a small percentage of users, but a sale is a sale and I would hate to lose even one of my customers because they can't log on.

Thanks!!

[angeleyz]

A buggy IE -- that I will definitely buy! LOL Sorry, I don't have any answers for you then other than what has already been suggested of puttnig on your main page to try a different browser. I don't see that you would have any other option personally. JMO though -- I don't work for hostgator, so I can't help you on that end. Good luck!

[jbnova]

Gator Support, don't give up on me yet. Have I mentioned how much I love Host Gator! I'm sure you'll be able to work this one out.

I've done some more testing over the past few days and here's what I've discovered. Like you, I went to the Mac Store and gave https://www.sterlingsecure.com a try on OS 10.2.8 using IE 5.2.2. As usual, it loads the first time, but every additional time it gives the "security failure" warning and refuses to load the page. I'm guessing that if the https://www.sterlingsecure.com index page had graphics on it, they would show red x's the first time it loads. That's what happens with other links such as https://www.sterlingsecure.com/~jbnova.

I also had a friend give it a try on his Mac. Who tested the same scenario as you: Tried it on Safari in OS X 10.3.2 which is Safari 1.1.1 - Worked fine
Tried it in Explorer version 5.2.3 (5815.1), and got the error. I'm sure that you would have gotten the error in IE too, if you had refreshed the page.

So basically https://www.sterlingsecure.com is excluding everyone using IE 5+ for Mac!

And like I mentioned before, I don't get the error if I log onto https://secure.hostgator.com/order/. So what's different about that server?! They both use a certificate signed by GeoTrust, so the problem's not with the certificate.

Please, Please, Please consider making the server for https://www.sterlingsecure.com fall back on SSLv2 if it finds Mac IE 5. Or investigate another approach.

If you can set up a secure server for yourselves at https://secure.hostgator.com that works with IE 5+ for Mac, why can't you set up one for your hosting customers?!

Thanks!

[GatorBrent]

Having someone go to mac store again tomorrow to retry with refreshing multiple times.

[jbnova]

Thanks for giving it another try. You guys are the best!!

Since there are no graphics on the index page for https://www.sterlingsecure.com, you may want to also test it on a page with graphics so you can see what happens. Https://www.sterlingsecure.com/~jbnova would be an example (among others).

Thanks again! Happy New Year!

[jbnova]

Any luck? Did you give it another try? It's still not working when I try it on IE 5+ Mac.

I have a client that I can't bill until I get the secure portion of their site working for all users, and I need to know whether I'll have to host that particular site somewhere else.

I have no problem buying my own security certificate if you can get me set up on a server with the same configuration as https://secure.hostgator.com/.

Is https://www.sterlingsecure.com the only shared SSL you have?

Thanks!