Cannot establish HTTP/2 connection from OkHTTP/ALPN/Linux client with Apache HTTP

Question

Problem which I have is Linux related, as it does not occur when the same HTTP2 client runs from Windows.

$java -jar -Xbootclasspath/p:alpn-boot-8.1.9.v20160720.jar SampleOkHttp-1.0.jar https://192.168.1.10:8080/simple.html

HTTP/2 preface communication:

Windows

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS
>> 0x00000000     4 WINDOW_UPDATE
<< 0x00000000     6 SETTINGS
<< 0x00000000     4 WINDOW_UPDATE
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     0 SETTINGS      ACK
<< 0x00000003    86 HEADERS       END_HEADERS
<< 0x00000003   220 DATA          END_STREAM
h2
<< 0x00000000     8 GOAWAY

Linux

>> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
>> 0x00000000     6 SETTINGS      
>> 0x00000000     4 WINDOW_UPDATE 
>> 0x00000003    69 HEADERS       END_STREAM|END_HEADERS
<< 0x00000000     6 SETTINGS      
>> 0x00000000     0 SETTINGS      ACK
<< 0x00000000     8 GOAWAY        
<< 0x00000000     4 WINDOW_UPDATE 
<< 0x00000000     8 GOAWAY

Tried with Ubuntu\Fedora, from local\remote machine, with different java\alpn versions. I'm still getting GOAWAY. Why Apache in case of Linux sends GOAWAY message? How to fix it?

The GOAWAY frame contains an error code and optional debug data, could you dump those? https://tools.ietf.org/html/rfc7540#section-6.8 — Frederik Deweerdt, Oct 14 '16 at 13:31

score 1 · Answer 1 · answered Oct 17 '16 at 13:38

Problem occurred during cipher key negotiation.

Windows with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 had no issue.

Linux was rejected because tried to use TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA.

I solved issue by providing acceptable cipher keys in Apache config file conf/extra/httpd-ssl.conf described here.

In short I changed default settings for SSLCipherSuite on:

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

Cannot establish HTTP/2 connection from OkHTTP/ALPN/Linux client with Apache HTTP

1 Answers1