The server with apache-1.3.20-5 (it has mod_ssl-2.8.4-5) can not be accessed via https from MSIE 5.0, 128 bit. Netscape and MSIE seems OK.
I tried few other sites. https://www.ebetusa.com Apache/1.3.20 (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b https://www.ebetonline.co.nz Apache/1.3.20 (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6b and https://www.redhat.com/ and all they seems accessable from MSIE 5.0, 128 bit. In the same time MSIE 5.0 Does not work with my site which uses the same software (I tried both OpenSSL/0.9.5a and OpenSSL/0.9.6b, no difference). I also tried it with self-generated and real (from Verisign) certificates - same thing in both cases. The only workaround I found is to add SSLProtocol all -SSLv3 then I can access the site. It may be some weird problem with apache default configs. What settings may cause this?
I also would like to say that the problem is different than in FAQ. http://www.modssl.org/docs/2.8/ssl_faq.html#io-ie The MSIE is 128bit, not 56. The other settings are already in config.
Above I meant MSIE 5.5 is OK , MSIE 5.0 does not work
In addition: If I recompile apache and mod_ssl from scratch, no patches applied, default settings: then IT WORKS. If I use RedHat rpm (from rawhide) it 1. executes first https request OK, 2. all following requests (2,3,4,...) do not work. Again, this happenes only with MSIE 5.0. Netscape and MSIE 5.5 are OK
The problem (at least partially) related to the fact that httpd.conf which comes with rpm is missing <IfModule mod_ssl.c> ..... </IfModule> section which presents in original mod_ssl distribution. Putting this section to /etc/httpd/conf/httpd.conf makes MSIE 5.0 working. This is probably related to SSLSessionCache dbm:/var/run/apache_mod_ssl_scache option. The MSIE 5.0 seems does not work without SSL session cache. A very similar problem still exists with some specific MSIE 5.0 versions, but now I at least have much fewer errors than before.
The default configuration file does contain this section, but just to be sure we'll switch to including the patch from the mod_ssl source distribution in 1.3.20-9 and later. Thanks!
Thanks for the report. This bug is no longer present in the Apache httpd 2.0 packages in Red Hat Enterprise Linux and Fedora Core.