A SSL scenario (involving multiple SSL-servers)

------=_Part_8654_23422614.1145921583966
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello there,

I have few doubts, the scenario goes as below.

Scenario: There are 4 SSL-enabled Apache servers {A1, A2, A3, A4}, all of
them independently controlled and have valid certificates. Now, a "user" on
A1 designs an HTML page (index.html) that refers to images from all the 4
servers. The links to these images are specified in the HTML file using "
https://A[1-4]/..."

Questions:
1. A request for https://A1/~user/index.html comes, The requestor is going
to get a SSL connection from A1. And the content from A1 to the browser is
flowing through the SSL-tunnel. I think only the files that reside on A1 ar=
e
going to flow through this tunnel from A1 to the browser!? And the files
from A2, A3, and A4 are flowing through separate SSL-tunnels to the
browser!? Then the browser shows only one PADLOCK symbol, will it be for A1=
?
YES. Then what about the SSL-connections from A2, A3, and A4? How does
browser tells its user about these connections?

2. Or does A1 brings the files from A2, A3, and A4 that referred inside the
"index.html" file by the "user" and serves to the browser?

Am confused. Because my understanding was SSL is Secure socket layer, and
one cannot tamper with this tunnel. And I used to think, when I ask the
browser to open some URL, it opens a connection (by obtaining a socket, say
56789, from underlying OS) to the port 80 of URL server. Now I feel, if the
URL page has objects residing on other servers, my browser opens separate
sockets (different from 56789) for these objects.!? Please clarify my
doubts. Or point me to some guides et al.

Thank you for your patience.

--
Best Regards,
Vishwas.

------=_Part_8654_23422614.1145921583966
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello there,

I have few doubts, the scenario goes as below.

S=
cenario: There are 4 SSL-enabled Apache servers {A1, A2, A3, A4}, all of th=
em independently controlled and have valid certificates. Now, a "user&=
quot; on A1 designs an HTML page (
index.html) that refers to images from all the 4 servers. The links to thes=
e images are specified in the HTML file using " 4]/..">https://A[1-4]/..."

Questions:
1. A request for=
=20
com=
es, The requestor is going to get a SSL connection from A1. And the content=
from A1 to the browser is flowing through the SSL-tunnel. I think only the=
files that reside on A1 are going to flow through this tunnel from A1 to t=
he browser!? And the files from A2, A3, and A4 are flowing through separate=
SSL-tunnels to the browser!? Then the browser shows only one PADLOCK symbo=
l, will it be for A1? YES. Then what about the SSL-connections from A2, A3,=
and A4? How does browser tells its user about these connections?


2. Or does A1 brings the files from A2, A3, and A4 that referred in=
side the "index.html" file by the "user" and serves to =
the browser?

Am confused. Because my understanding was SSL is Secure=
socket layer, and one cannot tamper with this tunnel. And I used to think,=
when I ask the browser to open some URL, it opens a connection (by obtaini=
ng a socket, say 56789, from underlying OS) to the port 80 of URL server. N=
ow I feel, if the URL page has objects residing on other servers, my browse=
r opens separate sockets (different from 56789) for these objects.!? Please=
clarify my doubts. Or point me to some guides et al.


Thank you for your patience.

--
Best Regar=
ds,
Vishwas.

------=_Part_8654_23422614.1145921583966--
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: A SSL scenario (involving multiple SSL-servers)

------=_Part_5802_12525336.1145972232568
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Every item the browser requests, such as images, comes from a
unique/distinct connection.

So the links to the other web servers will result in independent connection=
s
to the other web servers. So you should be good to go.



On 4/24/06, Vishwas wrote:
>
> Hello there,
>
> I have few doubts, the scenario goes as below.
>
> Scenario: There are 4 SSL-enabled Apache servers {A1, A2, A3, A4}, all of
> them independently controlled and have valid certificates. Now, a "user" =
on
> A1 designs an HTML page ( index.html) that refers to images from all the =
4
> servers. The links to these images are specified in the HTML file using "
> https://A[1-4]/..."
>
> Questions:
> 1. A request for https://A1/~user/index.html l>comes, The requestor is going to get a SSL connection from A1. And the
> content from A1 to the browser is flowing through the SSL-tunnel. I think
> only the files that reside on A1 are going to flow through this tunnel fr=
om
> A1 to the browser!? And the files from A2, A3, and A4 are flowing through
> separate SSL-tunnels to the browser!? Then the browser shows only one
> PADLOCK symbol, will it be for A1? YES. Then what about the SSL-connectio=
ns
> from A2, A3, and A4? How does browser tells its user about these
> connections?
>
> 2. Or does A1 brings the files from A2, A3, and A4 that referred inside
> the "index.html" file by the "user" and serves to the browser?
>
> Am confused. Because my understanding was SSL is Secure socket layer, and
> one cannot tamper with this tunnel. And I used to think, when I ask the
> browser to open some URL, it opens a connection (by obtaining a socket, s=
ay
> 56789, from underlying OS) to the port 80 of URL server. Now I feel, if t=
he
> URL page has objects residing on other servers, my browser opens separate
> sockets (different from 56789) for these objects.!? Please clarify my
> doubts. Or point me to some guides et al.
>
> Thank you for your patience.
>
> --
> Best Regards,
> Vishwas.
>

------=_Part_5802_12525336.1145972232568
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Every item the browser requests, such as images, comes from a unique/distin=
ct connection.



So the links to the other web servers will result in independent
connections to the other web servers.  So you should be good to go. >

Re: A SSL scenario (involving multiple SSL-servers)

The first hit is going to be pretty expensive on the client, since it has
to negotiate four different sets of keys. Subsequent requests will be
better, but still take a bit of overhead on the client to decrypt each
connction pseduo-simultaneously.

Perhaps a better plan would have been to create a single (or
high-availability pair using "keepalived") SSL-terminating reverse proxy
that map requests for certain images to standard (http, not https)
webservers on a privately addressed network. This would cut down the
client workload by 75% if you've got four SSL servers. Pound (
http://www.apsis.ch/pound/ ) is a great SSL-terminating reverse proxy
that's very lightweight and fast. I've deployed it often and found it to
be very stable, flexible, and responsive. Even on oldish hardware, it ca=
n
terminate upwards of 400 SSL sessions per second... newer hardware would
obviously push that number higher. Additionally, it has a FAR smaller
footprint than say using Apache as proxy.

Kind Regards,
-dsp

> Every item the browser requests, such as images, comes from a
> unique/distinct connection.
>
> So the links to the other web servers will result in independent
> connections
> to the other web servers. So you should be good to go.
>
>
>
> On 4/24/06, Vishwas wrote:
>>
>> Hello there,
>>
>> I have few doubts, the scenario goes as below.
>>
>> Scenario: There are 4 SSL-enabled Apache servers {A1, A2, A3, A4}, all
>> of
>> them independently controlled and have valid certificates. Now, a "use=
r"
>> on
>> A1 designs an HTML page ( index.html) that refers to images from all t=
he
>> 4
>> servers. The links to these images are specified in the HTML file usin=
g
>> "
>> https://A[1-4]/..."
>>
>> Questions:
>> 1. A request for
>> https://A1/~user/index.htmlcomes, The
>> requestor is going to get a SSL connection from A1. And the
>> content from A1 to the browser is flowing through the SSL-tunnel. I
>> think
>> only the files that reside on A1 are going to flow through this tunnel
>> from
>> A1 to the browser!? And the files from A2, A3, and A4 are flowing
>> through
>> separate SSL-tunnels to the browser!? Then the browser shows only one
>> PADLOCK symbol, will it be for A1? YES. Then what about the
>> SSL-connections
>> from A2, A3, and A4? How does browser tells its user about these
>> connections?
>>
>> 2. Or does A1 brings the files from A2, A3, and A4 that referred insid=
e
>> the "index.html" file by the "user" and serves to the browser?
>>
>> Am confused. Because my understanding was SSL is Secure socket layer,
>> and
>> one cannot tamper with this tunnel. And I used to think, when I ask th=
e
>> browser to open some URL, it opens a connection (by obtaining a socket=
,
>> say
>> 56789, from underlying OS) to the port 80 of URL server. Now I feel, i=
f
>> the
>> URL page has objects residing on other servers, my browser opens
>> separate
>> sockets (different from 56789) for these objects.!? Please clarify my
>> doubts. Or point me to some guides et al.
>>
>> Thank you for your patience.
>>
>> --
>> Best Regards,
>> Vishwas.
>>
>


____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: A SSL scenario (involving multiple SSL-servers)

--0-768657901-1146010395=:77155
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

remove now!

BJ Swope wrote: Every item the browser requests=
, such as images, comes from a unique/distinct connection.

So the links to the other web servers will result in independent connecti=
ons to the other web servers. So you should be good to go.



On 4/24/06, Vishwas wrote: Hello there,

I have few doubts, the scenario goes as below.

Scenario: There are 4 SSL-enabled Apache servers {A1, A2, A3, A4}, all of=
them independently controlled and have valid certificates. Now, a "user"=
on A1 designs an HTML page ( index.html) that refers to images from all =
the 4 servers. The links to these images are specified in the HTML file u=
sing "https://A[1-4]/..."

Questions:
1. A request for https://A1/~user/index.html comes, The requestor is goin=
g to get a SSL connection from A1. And the content from A1 to the browser=
is flowing through the SSL-tunnel. I think only the files that reside on=
A1 are going to flow through this tunnel from A1 to the browser!? And th=
e files from A2, A3, and A4 are flowing through separate SSL-tunnels to t=
he browser!? Then the browser shows only one PADLOCK symbol, will it be f=
or A1? YES. Then what about the SSL-connections from A2, A3, and A4? How =
does browser tells its user about these connections?=20

2. Or does A1 brings the files from A2, A3, and A4 that referred inside t=
he "index.html" file by the "user" and serves to the browser?

Am confused. Because my understanding was SSL is Secure socket layer, and=
one cannot tamper with this tunnel. And I used to think, when I ask the =
browser to open some URL, it opens a connection (by obtaining a socket, s=
ay 56789, from underlying OS) to the port 80 of URL server. Now I feel, i=
f the URL page has objects residing on other servers, my browser opens se=
parate sockets (different from 56789) for these objects.!? Please clarify=
my doubts. Or point me to some guides et al.=20

Thank you for your patience.

--=20
Best Regards,

Vishwas.=20




=09
---------------------------------
Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ co=
untries) for 2=A2/min or less.
--0-768657901-1146010395=:77155
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

remove now!

BJ Swope <bigblueswope@gmail.com> =
wrote:

T: 5px; BORDER-LEFT: #1010ff 2px solid">Every item the browser requests, =
such as images, comes from a unique/distinct connection.

So the li=
nks to the other web servers will result in independent connections to th=
e other web servers.  So you should be good to go.



=

On 4/24/06, Vi=
shwas <ivishwas@gmail.com >> wrote:

T: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px soli=
d">

Hello there,

I have few doubts,=
the scenario goes as below.

Scenario: There are 4 SSL-enabled Apa=
che servers {A1, A2, A3, A4}, all of them independently controlled and ha=
ve valid certificates. Now, a "user" on A1 designs an
HTML page ( index.html) that refers to images from all the 4 servers. Th=
e links to these images are specified in the HTML file using "https://=
A[1-4]/..."

Questions:
1. A request for n top.js.OpenExtLink(window,event,this)" href=3D"https://a1/%7Euser/index=
..html" target=3D_blank>https://A1/~user/index.html comes, The request=
or is going to get a SSL connection from A1. And the content from A1 to t=
he browser is flowing through the SSL-tunnel. I think only the files that=
reside on A1 are going to flow through this tunnel from A1 to the browse=
r!? And the files from A2, A3, and A4 are flowing through separate SSL-tu=
nnels to the browser!? Then the browser shows only one PADLOCK symbol, wi=
ll it be for A1? YES. Then what about the SSL-connections from A2, A3, an=
d A4? How does browser tells its user about these connections?

2.=
Or does A1 brings the files from A2, A3, and A4 that referred inside the=
"index.html" file by the "user" and serves
to the browser?

Am confused. Because my understanding was SSL is =
Secure socket layer, and one cannot tamper with this tunnel. And I used t=
o think, when I ask the browser to open some URL, it opens a connection (=
by obtaining a socket, say 56789, from underlying OS) to the port 80 of U=
RL server. Now I feel, if the URL page has objects residing on other serv=
ers, my browser opens separate sockets (different from 56789) for these o=
bjects.!? Please clarify my doubts. Or point me to some guides et al. >
Thank you for your patience.

--
Best Regards,=

Vishwas. N>