FIX: "An unknown error occurred while processing the certificate" error when you access an application that is hosted on an Apache web server

Symptoms

When you access an application that is hosted on an Apache web server through Microsoft Forefront Unified Access Gateway 2010, you may receive the following error message:

Note This problem occurs only if the connection from Forefront Unified Access Gateway to the Apache server is made over HTTPS.

Cause

This problem can occur if the web server returns a response that includes no content-length header but instead includes a "Connection:close" header and ends the TCP connection to signify the end of the response. Schannel decrypts the message and returns SEC_I_CONTEXT_EXPIRED to Forefront Unified Access Gateway to indicate that the sender closed the connection. However, Forefront Unified Access Gateway mistakenly interprets this as an error condition.

Resolution

This problem is fixed in Rollup 1 for Forefront Unified Access Gateway 2010 Service Pack 4.

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

You can see this problem in the following Forefront Unified Access Gateway tracing:

[whlfilter CExtECB::OnRecvSrvrDataCompleted WhlExt2IWS.cpp@3301]
Info:Response from RWS to filter (ExtECB=00000000136ABA70), (PFC=000000000CBAB2D8) ---[HTTP/1.1 200 OK
Pragma: No-cache
Cache-Control: no-cache
Expires: datetime
X-Powered-By: Servlet 2.4; Tomcat-5.0.28/JBoss-3.2.6 (build: CVSTag=JBoss_3_2_6 date=date)
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
Date: date time GMT
Server: Apache-Coyote/1.1
Connection: close
[sslbox SSLMachine::HandleDecryptMessageError SSLMachine.cpp@753] ERROR:SSLMachine::Read(): DecryptMessage failed (SEC_I_CONTEXT_EXPIRED) Error: 997

References

Learn about the terminology that Microsoft uses to describe software updates.