FIX: "An unknown error occurred while processing the certificate" error when you access an application that is hosted on an Apache web server

View products that this article applies to.

Symptoms

When you access an application that is hosted on an Apache web server through Microsoft Forefront Unified Access Gateway 2010, you may receive the following error message:

An unknown error occurred while processing the certificate.

Note This problem occurs only if the connection from Forefront Unified Access Gateway to the Apache server is made over HTTPS.

↑ Back to the top

Cause

This problem can occur if the web server returns a response that includes no content-length header but instead includes a "Connection:close" header and ends the TCP connection to signify the end of the response. Schannel decrypts the message and returns SEC_I_CONTEXT_EXPIRED to Forefront Unified Access Gateway to indicate that the sender closed the connection. However, Forefront Unified Access Gateway mistakenly interprets this as an error condition.

↑ Back to the top

Resolution

This problem is fixed in Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 4.

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

More Information

You can see this problem in the following Forefront Unified Access Gateway tracing:

[whlfilter CExtECB::OnRecvSrvrDataCompleted WhlExt2IWS.cpp@3301]
Info:Response from RWS to filter (ExtECB=00000000136ABA70), (PFC=000000000CBAB2D8) ---[HTTP/1.1 200 OK
Pragma: No-cache
Cache-Control: no-cache
Expires: datetime
X-Powered-By: Servlet 2.4; Tomcat-5.0.28/JBoss-3.2.6 (build: CVSTag=JBoss_3_2_6 date=date)
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
Date: date time GMT
Server: Apache-Coyote/1.1
Connection: close
[sslbox SSLMachine::HandleDecryptMessageError SSLMachine.cpp@753] ERROR:SSLMachine::Read(): DecryptMessage failed (SEC_I_CONTEXT_EXPIRED) Error: 997

↑ Back to the top