Subject: Apache + MOD_SSL Win32 crash

From: "Mike Campbell" <[email-masked]>
Date: Thu, 23 May 2002 13:48:56 -0700

Hello,
I'm running Apache 1.3.24 with MOD_SSL 2.8.8 on a Windows 2000 server.

I've installed and configured according to the "Apache + SSL on Win32 Howto" <http://tud.at/programm/apache-ssl-win32-howto.php3> and I've gotten a certificate from Thawte. I can and always have been able to make an (unsecure) http hit on the server. I can also make a secure https hit. However, if I reload the secure page a few times, sooner or later Apache crashes.

The error message that pops up says "Apache.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created." The Windows error log says it was an access violation and gives a stack dump, which I don't know how to read. The Apache error log and the SSL log are free of errors.

When starting Apache, the only complaint I was getting from the config file was:
"Cannot add module via name 'mod_ssl.c': not in list of loaded modules"
so I've commented that line out.

Does anyone have any suggestions?

These are the relevant lines in httpd.conf:

 ### (other AddModules) ###
#AddModule mod_ssl.c
...

 ### (other LoadModules) ###
LoadModule ssl_module modules/mod_ssl.so
...

Listen 80
Listen 443
...

SSLMutex sem
SSLRandomSeed startup builtin
SSLSessionCache none

SSLLog logs/SSL.log
SSLLogLevel info

<VirtualHost XXX.XXX.XXX.XXX:80>
DocumentRoot c:/...
ServerName www.mydomain.com
</VirtualHost>
...

 ### (many other VirtualHosts) ###

<VirtualHost XXX.XXX.XXX.XXX:443>
SSLEngine On
SSLCertificateFile conf/ssl/pubkey.cert
SSLCertificateKeyFile conf/ssl/prvkey.key
DocumentRoot c:/...
ServerName www.mydomain.com
</VirtualHost>

-------------------------------------------------
Mike Campbell          Aktiv Software Corporation
[email-masked]          http://www.aktiv.com
(250) 708-0027

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 24 May 2002 00:34:08 -0400 (EDT)

What else might be running on this system?  If it were me, I'd move
everything to a solid unix based system.  Widows does not play well with
others, not ready for prime time, but, that's me.

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Peter Viertel" <[email-masked]>
Date: Fri, 24 May 2002 07:52:45 +0100

That sounds like the ssl mutex mechanism not working properly. Not sure 
whether anyones got it working on win32 and mod_ssl on win32 is still 
listed as an alpha release.

I too would choose to ditch windows, but if you do need it, then you 
should try apache 2 at least the asf say its production quality on win32 
- not sure if there are precompiled win32 binaries with ssl though.

Mike Campbell wrote:

> I've installed and configured according to the "Apache + SSL on Win32 
> Howto" <http://tud.at/programm/apache-ssl-win32-howto.php3> and I've 
> gotten a certificate from Thawte. I can and always have been able to 
> make an (unsecure) http hit on the server. I can also make a secure 
> https hit. However, if I reload the secure page a few times, sooner or 
> later Apache crashes.
>  
> The error message that pops up says "Apache.exe has generated errors 
> and will be closed by Windows. You will need to restart the program. 
> An error log is being created." The Windows error log says it was an 
> access violation and gives a stack dump, which I don't know how to 
> read. The Apache error log and the SSL log are free of errors.
>  
> ServerName www.mydomain.com <http://www.mydomain.com>
> </VirtualHost>
> ...
>  
> ServerName www.mydomain.com <http://www.mydomain.com>
> </VirtualHost>
>  
>  
> [email-masked] <mailto:[email-masked]>          
> http://www.aktiv.com
> (250) 708-0027

---

From: "Enrico Demarin" <[email-masked]>
Date: Fri, 24 May 2002 09:46:08 +0200

This (again) sounds like the keep-alive bug : 

see

http://www.mail-archive.com/[email-masked]/msg12969.html

- Enrico
  ----- Original Message ----- 
  From: Mike Campbell 
  To: [email-masked] 
  Sent: Thursday, May 23, 2002 10:48 PM
  Subject: Apache + MOD_SSL Win32 crash

  Hello,

  Listen 80
  Listen 443
  ...

  SSLMutex sem

  SSLLog logs/SSL.log
  SSLLogLevel info

---

From: "Mike Campbell" <[email-masked]>
Date: Fri, 24 May 2002 01:06:05 -0700

Wow, thanks! That solved the problem.
Wasn't expecting such an easy fix. :)

Mike
  ----- Original Message ----- 
  From: Enrico Demarin 
  To: [email-masked] 
  Sent: Friday, May 24, 2002 12:46 AM
  Subject: Re: Apache + MOD_SSL Win32 crash

  see

  - Enrico
    ----- Original Message ----- 
    From: Mike Campbell 
    To: [email-masked] 
    Sent: Thursday, May 23, 2002 10:48 PM
    Subject: Apache + MOD_SSL Win32 crash

    Hello,

    Listen 80
    Listen 443
    ...

    SSLMutex sem

    SSLLog logs/SSL.log
    SSLLogLevel info

---

From: "Aryeh Katz" <[email-masked]>
Date: Fri, 24 May 2002 08:07:09 -0400

One more thing. You might want to put your AddModule after your LoadModule, and see if it complains about the "Cannot load.." message below.
Aryeh
> ServerName www.mydomain.com

---
Aryeh Katz
VASCO 			
www.vasco.com