CSS11503 - SSL Module Issue

Brendan O'Flynn · ‎02-19-2009

Has anyone come across situations where an SSL module (CSS5-SSL-C-K9) stops responding and users get "Page connot be displayed".

When you try and look at the SSL statistics (sh ssl statistics ssl) you get the following error message:

Timeout waiting for SSL_SHOW_MSG response

Accessing and interrogating the redundant CSS, with the same command, was not a problem. There was no failover as, I suppose, this would be regarded as a "soft" failure (i.e. all critical services and the SSl service itself were OK).

The was no indication of any issues being reported in the traplog or sys.log. A few days previous to this event occurring I had amended the set-up which necessitated doing extensive re-configuring, suspending and re-activating the SSL proxy-list.

We have dual CSS11503, running 08.20.2.01, in a Master/Slave redundant set-up.

Thanks,

Brendan

lalvenka · ‎02-20-2009

Hi Brendan,

Given this error message and your CSS version information, you might be hitting a bug. There is a bug that you can look online using the Cisco bug tool kit for this bug "CSCsm50650 - Header insert can cause the SSL module to become unresponsive". If you have configured http-header insert under the SSL proxy list, then this bug is applicable in your scenario.

Mostly rebooting the CSS should resolve the issue. I would recommend you to open a TAC case if this issue exist after the reboot also.

Thanks,

Lalitha

Brendan O'Flynn · ‎02-23-2009

Hi Lalitha,

Yes, we do have http-header insert configured. I can also confirm that a reboot fixed the issue (forgot to mention this in my original mail).

Have you noticed this issue occurring regularly for this code version? I will review the release notes for latest code release and upgrade if possible.

Thanks for your help and prompt response on this.

Brendan

lalvenka · ‎02-24-2009

Hi Brendan,

I was just looking for the bug information based on your email. I have not seen much issues regarding to the error message that you received. It is always better to be on the latest version on code as far as possible.

Thanks,

Lalitha