Subject: RE: Apache 2.0.35 with SSL - wont start

From: Lynn Gazis <[email-masked]>
Date: Tue, 16 Apr 2002 09:16:22 -0700

s_client doesn't handshake OK with it, Rainbow's show test program doesn't
handshake OK with it, and swamp doesn't handshake OK with it.  I've been
wondering what load testing program *does* handshake properly with Apache
2.0 (I really need to be able to test it, somehow, under load, and so far
I've only been able to make single connections from IE and Netscape).  Maybe
your suggestion is right, and it doesn't like the "GET /\r/\n\r\n" request
string; I suppose that could explain why several different programs would be
able to send traffic to Apache 1.3 and not to Apache 2.0.

Lynn Gazis

-----Original Message-----
From: Geoff Thorpe [mailto:[email-masked]]
Sent: Monday, April 15, 2002 6:57 PM
To: [email-masked]
Cc: Lynn Gazis
Subject: Re: Apache 2.0.35 with SSL - wont start

Hi Lynn,

Not having the time to deal with 2.0.** right now, I haven't been keeping an

eye on how swamp is finding it. In principle however, swamp's satisfaction 
with Apache 2.0 should be roughly equivalent to that of "openssl s_client". 
However, if Apache 2.0 itself doesn't like the "GET /\r/\n\r\n" request 
string, that might explain a termination or something - but again, you could

verify that using s_client. Does s_client handshake OK with it?

If all else fails, please contact me off the list and I'll send some ideas 
about how to trace this.

Cheers,
Geoff

On Tuesday 16 April 2002 04:06, you wrote:
> I got that as well; I found that, while with Apache 1.3 I only needed to
> set ServerName in httpd.conf, in Apache 2.0 I needed also to edit both
> httpd.conf and ssl.conf and change the "0.0.0.0" in both files to my
> system's real IP address (and, since I didn't care to test as root, change
> the port numbers to 8080 and 8443).
>
> I still haven't figured out why I can connect with IE but get nothing but
> errors from swamp, though (I can use swamp just fine with Apache 1.3).
>
> Lynn Gazis
>
> -----Original Message-----
> From: paul priestman [mailto:[email-masked]]
> Sent: Monday, April 15, 2002 5:59 AM
> To: [email-masked]
> Subject: Apache 2.0.35 with SSL - wont start
>
>
> Hello all,
>
> I have downloaded and installed Apache 2.0.35 with SSL.  I have configured
> the httpd.conf as they suggest in ssl.conf.  However, when i try to start
> apachectl i get the following message:
>
> (13)Permission denied: make_sock: could not bind to address 0.0.0.0:443
> no listening sockets available, shutting down
> ./apachectl startssl: httpd could not be started
>
> Has anyone any ideas what i'm doing wrong - i have succesfully got ssl
> working with apache 1.3.22.
>
> Thanks for your time
>
> Paul
>
> _________________________________________________________________
> Chat with friends online, try MSN Messenger: http://messenger.msn.com
>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Geoff Thorpe <[email-masked]>
Date: Thu, 18 Apr 2002 01:42:03 +1200

Hi,

On Wednesday 17 April 2002 04:16, Lynn Gazis wrote:
> I've only been able to make single connections from IE and Netscape). 

Ah, well then it would appear to be SSL/TLS weirdness with Apache 2.0.

> Maybe your suggestion is right, and it doesn't like the "GET /\r/\n\r\n"
> request string; I suppose that could explain why several different programs
> would be able to send traffic to Apache 1.3 and not to Apache 2.0.

If you can't get s_client to handshake with Apache 2, then it is rather 
irrelevant what request string you send through the SSL stream. It requires 
an SSL/TLS stream to be open to begin with. Quite weird really ...

It's hard to tell right off the bat what this could be - but it sounds weird 
as I'm sure *someone* working on the SSL functionality in apache 2.0 must 
have tried hitting it with *something* built around openssl. How about 
konqueror, lynx, or some other browser whose SSL support comes from openssl? 

Otherwise, I think it would require a comment from someone dealing with 
Apache 2.0 - there seemed to be one or two people saying it was ready for 
production and that it was now time for the 1.3->2.0 switch ... surely one of 
these could clarify the situation? :-)

Cheers,
Geoff