GNU/Linux

I posted my question to comp.os.linux.security and continued the discussion on the Serendipity mailing list. For the sake of documentation and to provide another spot in the net with a solution, I repeat the posting here:

I wondered about strange HTTP connections from 127.0.0.1 appearing in my access.log at irregular times:

What irritated me was that those requests originate locally, are invalid (400 = Bad Request) and have no User-Agent identification string. [...]

I finally found out that this ought to be Apache-2.2’s internal dummy connections. They had the above form as long as my Apache-SSL config looked like

Now, I use the IP instead of the ‘*’ and—lo and behold—the requests transform into

I didn’t want to spend much time trying to understand what that dummy connections are good for. It seems like Apache2 kills some of its children such that the number of MaxSpareServers isn’t exceeded. And I wasn’t aware that the Apache syntax ‘*:443’ is somehow deprecated.