We have a secure site accessed by many many users every day. But some
(maybe all) Macintosh users are unable to access our secure pages.

They get errors like: "Security Failure. Data Encryption Error"

My question is "What must be done to allow users who get this message
to access our pages successfully?"

And no, you can't tell me to have them run windows instead :P

I'm not sure of the success my answer will have given that I don't
know the specific security you're using or the site's address.  If
these suggestions don't work by all means please ask for a
clarification with any additional information.  That said, I can
suggest to you some simple steps that *should* solve the problem.

The specific error "Security Failure. Data Encrpytion Error" sounds
like a Microsoft IE error message.  If your Macintosh users are
running IE 5, let them know about a service pack
http://www.microsoft.com/mac/download/ie/ie50_sr1.asp) that most
likely should solve their error.

This site notes that the IE update solves the problem for users who
install it *and* are running OS 9.2. 
)(http://www.grassrootsfundraising.org/help/)

From my above site (and from personal experience), it looks like
Netscape 4.7x and 6.1 as well as Mozilla 1.0 should work without
error.

Another suggestion is to tell your site users to upgrade their
browsers to 128 bit encrpytion, which is freely available for most
browsers if they are in the US.

And by the way, I love my Mac. I'd never tell you to run windows!
Quite the opposite actually :-)

Search Strategy:
mac Security Failure. Data Encryption Error

Regards,
andyt-ga

---

Clarification of Answer by andyt-ga on 19 Jun 2002 23:54 PDT

If any of your users use IE on OS X, the service pack mentioned above
won't work for them.  Instead, you should point them to
http://www.microsoft.com/mac/DOWNLOAD/IE/ie52.asp

---

Request for Answer Clarification by button-ga on 20 Jun 2002 01:07 PDT

I do not think this is the same issue.

The most recent sufferer from this problem is using both IE6 and the
latest candidate release of Mozilla. It doesn't work with either
browser.

He is a mac os 10.1.5 

I suspect that the encryption stuff is an operating system service
that both browsers use and that the problem is in that service.

---

Clarification of Answer by andyt-ga on 20 Jun 2002 10:19 PDT

Hi again,
To the best of my knowledge, IE 6 does not yet exist for the mac
platform.  Is the site you are talking about alive and running now? 
If so, can you post the address?  I'd very much like to try out
different browswers to see if I can duplicate the same encryption
error.

---

Request for Answer Clarification by button-ga on 20 Jun 2002 20:13 PDT

Hello,

About IE6 for mac, i dunno; i only tell you, what the users tell me :)

I asked a tech to scan recent logs and pull up all browser strings
with "Mac" in them. Here it is, successful connections come from:

Mozilla/4.5 (Macintosh; I; PPC)
Mozilla/4.7 (Macintosh; I; PPC)
Mozilla/4.75C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; U; PPC)
Mozilla/4.78 (Macintosh; U; PPC)
Mozilla/4.78C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; U; PPC)
Mozilla/4.79 (Macintosh; U; PPC)
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:0.9.4)
Gecko/20011022 Netscape6/6.2
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:0.9.4.1)
Gecko/20020315 Netscape6/6.2.2
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:0.9.4.1)
Gecko/20020508 Netscape6/6.2.3
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:0.9.9)
Gecko/20020310
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0.0)
Gecko/20020529
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0rc1)
Gecko/20020417
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0rc2)
Gecko/20020510
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0rc3)
Gecko/20020523
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.1a)
Gecko/20020610
Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.4) Gecko/20011022
Netscape6/6.2
Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.4) Gecko/20011130
Netscape6/6.2.1

It looks a lot like we don't support connections from Mac IE or Opera
users. It's possible that our client list is small enough not to have
mac opera users, but ie? there's gotta be people trying and failing :(

My users are not alway technical folks, so the details I get aren't
always accurate. I don't have a mac to play with so I especially
appreciate any time a real mac user might be willing to spend looking
at this.

The secure pages are in our user control panel. Access the demo
account with username: demo and password: vodsaigg

http://www.protgp.com/members

Please do not set up a warez site on the demo account. It'd make me
look bad :P

Umm, what else can I say that might be useful, oh, we use mod_ssl.

---

Clarification of Answer by andyt-ga on 20 Jun 2002 23:45 PDT

Hi button, 
I am currently working on your problem.  As I type I'm downloading an
OS update to 9.2.  I'll post again with my full report in about an
hour.

---

Clarification of Answer by andyt-ga on 21 Jun 2002 01:16 PDT

Rest assured I did nothing with your demo account but login (or try to
login).  However, I advise you to disable the account, as this is a
publicly accessible forum.  Coincidentally, I am just getting started
in a type of site where I might need a host like yours.  I'll
definitely keep you in mind.

I tried to login to your members site with a variety of browsers and
versions of the Mac OS.  From my results results two things can be
determined.

First, Internet Data Encrpytion is not an OS service on the mac.  The
results support that regardless of the OS version, the respective
browsers worked or didn't work.

Second, Internet Explorer on the Macintosh simply does not support
newer encrption standards.  I would recommend to your users to switch
to Mozilla, Netscape, or Icab instead of dealing with IE.  Most will
probably already have one of these browsers installed, if not they all
can be freely obtained.

As much as it might be a pain for you and your users that Microsoft's
product doesn't work as advertised,  it brings a smile to my face,
being the big Mozilla fan that I am :-)

I plan on asking a Microsoft representative why IE doesn't work on
newer encryption when I attend the Macworld Expo July 17th-19th.  I
looked into calling their tech support department, but it was not a
free service, so it was outside the scope of this report.

The following is my results using an array of browsers and operating
systems:

Mozilla 1.0 using 9.04
Login Successful

Netscape Communicator 4.7 using 9.04
Login Successful

Microsoft IE 5.0 using Mac OS 9.0.4
Unsuccessful: Security Failure. Data Encryption Error

Microsoft IE 5.1 using Mac OS 9.0.4
Unsuccessful: Security Failure. Data Encryption Error

Icab 2.8 using 9.0.4
Login Successful

Mozilla 1.0 using 9.1
Login Successful

Netscape Communicator 4.7 using 9.1
Login Successful

Microsoft IE 5.0 using Mac OS 9.1
Unsuccessful: Security Failure. Data Encryption Error

Microsoft IE 5.1 using Mac OS 9.1
Unsuccessful: Security Failure. Data Encryption Error

Icab 2.8 using 9.1
Login Successful

(I never felt the need to upgrade to 9.2 until tonight, thanks for
giving me the incentive :-) )

Mozilla 1.0 using 9.2
Login Successful

Netscape Communicator 4.7 using 9.2
Login Successful

Microsoft IE 5.0 using Mac OS 9.2
Unsuccessful: Security Failure. Data Encryption Error

Microsoft IE 5.1 using Mac OS 9.2
Unsuccessful: Security Failure. Data Encryption Error

Icab 2.8 using 9.2
Login Successful

Resources:

Free Mac OS 9.2 Update:
http://docs.info.apple.com/article.html?artnum=120030

Mozilla Mac download
http://www.mozilla.org/releases/stable.html

Icab Mac download
http://www.icab-soft.de/download.html

I believe that I've covered everything, but if there are anymore
questions you might have, feel free to request another clarification. 
I encourage you to rate me if my answer was helpful.

Your resident Mac specialist,
andyt-ga

---

Request for Answer Clarification by button-ga on 21 Jun 2002 09:27 PDT

Thank you andy :) I really appreciate knowing so much more about where
we stand with this. I am going to put up a few more questions related
to this issue and would be happy if you happened to get those too.

---

Clarification of Answer by andyt-ga on 22 Jun 2002 20:29 PDT

Glad to be of help. (I'm responding because in my account center it
still says that this answer needs clarification)

Thanks for the question again!

Can we say run linux? *snicker* j/k

Hello,

I have found this problem with two web sites. I reported the problem
to the site owners and one was running FreeBSD and the other Linux.
Apache with OpenSSL were common to both. They were also running one
Instance of Apache configured to hande Secure and Non-Secure
transactions. The solution after a lot of testing was to run two
seperate instances of Apache. One to handle HTTP and the other to
handle HTTPS.

Oops, my comment was not quite complete. In both of the cases there
servers had no problems with any browser Mac or PC except IE for the
Mac.

riegel, 
I'm glad to hear your findings compare favorably with my research! :) 
I think Microsoft addressed the problem with IE on Mac OS 9.2 with
it's service upgrade.  However, with OS X, IE is horrendous (hopefully
it will be fixed soon--hint MWNY).  i would most definitely reccomend
Chimera, Opera, Mozilla, or Icab over IE.

Hi button,
I am currently working on your problem.  As I type I'm downloading an
OS update to 9.2.  I'll post again with my full report in about an
hour.

andyt,

No it wasn't addressed with 9.2 as this is something I have tested
regularly. I have a site that I know exhibits the problem so I go to
it to test my browsers and the like with secure connections on a mac.

I do really like Mozilla, it is great. I keep a copy of just about
everything around for testing and debugging my html. I would like to
see the playing field leveled and Microsoft's refusal to address this
might just help in doing that.

So far, all of the suggested fixes are on the client side. 
That's fine, but if the client cannot always be expected
to willingly change or upgrade browsers, a server side
workaround may be of interest.

One server side fix proposed on the interchange-users
mailing list is found here:

http://developer.akopia.com/archive/interchange-users/2001/msg01739.html

Specifically, the proposed fix to the SSL section of your
Apache configuration is:

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

This change will affect overall performance since it affects all IE users,
not just Mac users; you might explore whether you can finesse that with a
more specific regular expression. I haven't tried this fix myself but the
accompanying text is very promising.

Another fix which more thoroughly downgrades the capabilities of Apache
to ensure compatibility with IE is shown here:

http://www-uxsup.csx.cam.ac.uk/~jw35/docs/CA_and_cert_notes

Specifically:

BrowserMatch "MSIE [1-4]" nokeepalive ssl-unclean-shutdown \
      downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [5-9]" ssl-unclean-shutdown

Other commentators suggest that turning off SSL version 3 altogether
does the job, but at the possible expense of offending other users
or being rejected outright by newer browsers (not good, of course).