Subject: RE: Apache 2 + SSL Problems

From: "MATHIHALLI,MADHUSUDAN (HP-Cupertino,ex1)" <[email-masked]>
Date: Mon, 21 Jan 2002 13:32:36 -0500

Laurie,
	What version of Apache 2.0 / what platform are you using ??.. Also,
did you run into any compilation issues ?..

-Madhu

-----Original Message-----
From: Laurie Young [mailto:[email-masked]]
Sent: Monday, January 21, 2002 8:02 AM
To: [email-masked]
Subject: Apache 2 + SSL Problems

Hi,

I'm trying to get Apache 2 to work with SSL to set up an https server. I
presume I am getting something wrong.

When I try to access the site the connection times out and I get:
[Mon Jan21 12:53:11 2002] [error] [client 127.0.0.1] Invalid method in
request
written to the log file

I have attached a copy of my http.conf file

-- 
==================================================
              Laurie Robert Young
[email-masked]  |       [email-masked]
www.wildfalcon.com     |  www.doc.ic.ac.uk/~laurie
              ICQ UIN #20194782
==================================================

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Laurie Young <[email-masked]>
Date: Tue, 22 Jan 2002 10:19:05 +0000 (GMT)

Hi

Its running with on a SuSE Linux install
Apapche 2.0.28
ModSSL compiled into apache
No problems with compilation (though I had problems getting modssl to
compile as a DSO I had no problems compiling it into the main binary)

If I try and connect with openssl to see whats going on I get:
[laurie@stone src]$ openssl s_client -connect localhost:443 -state -debug
CONNECTED(00000003)
SSL_connect:before/connect initialization
write to 0814B5A0 [0814B5E8] (130 bytes => 130 (0x82))
0000 - 80 80 01 03 01 00 57 00-00 00 20 00 00 16 00 00   ......W... .....
0010 - 13 00 00 0a 07 00 c0 00-00 66 00 00 07 00 00 05   .........f......
0020 - 00 00 04 05 00 80 03 00-80 01 00 80 08 00 80 00   ................
0030 - 00 65 00 00 64 00 00 63-00 00 62 00 00 61 00 00   .e..d..c..b..a..
0040 - 60 00 00 15 00 00 12 00-00 09 06 00 40 00 00 14   `...........@...
0050 - 00 00 11 00 00 08 00 00-06 00 00 03 04 00 80 02   ................
0060 - 00 80 08 92 0d f4 b5 83-60 ae 0b fb 3b 92 08 79   ........`...;..y
0070 - 92 79 cf 8c c6 57 64 72-96 4c 0d 63 8d 1f 71 7f   .y...Wdr.L.c..q.
0080 - 62 e3                                             b.
SSL_connect:SSLv2/v3 write client hello A
read from 0814B5A0 [08150B48] (7 bytes => 7 (0x7))
0000 - 3c 21 44 4f 43 54 59                              <!DOCTY
SSL_connect:error in SSLv2/v3 read server hello A
11506:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:460:

Any ideas?

Laurie

---

From: Teodor Cimpoesu <[email-masked]>
Date: Tue, 22 Jan 2002 11:28:51 +0200

Hi Laurie!

> 0010 - 13 00 00 0a 07 00 c0 00-00 66 00 00 07 00 00 05   .........f......
 It looks like the server started to talk plain HTTP .......^
maybe it falled back to NULL?

> 11506:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
-- teodor

---

From: Laurie Young <[email-masked]>
Date: Tue, 22 Jan 2002 11:19:59 +0000 (GMT)

> maybe it falled back to NULL?

Errr....

What does that mean?

Laurie

---

From: Mads Toftum <[email-masked]>
Date: Tue, 22 Jan 2002 11:26:38 +0100

> > maybe it falled back to NULL?
This basically means that your server is speaking HTTP and _not_ HTTPS.
Perhaps you have forgotten something like SSLEngine on in your vhost
config.

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "R. DuFresne" <[email-masked]>
Date: Tue, 22 Jan 2002 05:46:01 -0500 (EST)

You might save some time here by showing your httpd.config.

And of course you start your server with:  apachectl startssl

yes?

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Teodor Cimpoesu <[email-masked]>
Date: Tue, 22 Jan 2002 12:47:39 +0200

Hi Laurie!

> > maybe it falled back to NULL?
it means your server was started with -DSSL (so it will listen on 443) but no
SSLEngine On was present arround, or, you did all that but it failed to
negociate a cipher (my wild guess), though then it shouldn't even talk cuz it
isn't secure anymore.

-- teodor

---

From: Laurie Young <[email-masked]>
Date: Tue, 22 Jan 2002 12:09:25 +0000 (GMT)

I have tried starting it with
./apachectrl start
and with
./apachectrl startssl

both give the same errors

It would be good if someone could have a look at my httpd.config file,
which I have included as an attachment

Laurie

---

From: Teodor Cimpoesu <[email-masked]>
Date: Tue, 22 Jan 2002 13:28:16 +0200

Hi Laurie!

> which I have included as an attachment
I don't remember if you said how did you compiled the SSL support (deleted
the mesgs) was it as a loadable module? If so, add a LoadModule directive,
cause:

> PidFile logs/httpd.pid
> Timeout 300
> Listen 8080
> Listen 443
....^ you listen on 443 either mod_ssl is loaded or not.

> <VirtualHost 146.169.4.13:443>
.................^ virtual host where sslengine is on sais a different IP
than what you've tried from command line (namely 127.0.0.1 aka localhost).

So, 1st, if your mod_ssl is loadable then load it :) then test ssl by
connecting to the above ip addr for testing.

gl

-- teodor

---

From: Laurie Young <[email-masked]>
Date: Tue, 22 Jan 2002 12:47:13 +0000 (GMT)

> the mesgs) was it as a loadable module? If so, add a LoadModule directive,

I had some problems with DSO (apxs insisted on producing .la files instead
of .dso files) so I gave up on that and compilied modssl into the main
apache binary

> ....^ you listen on 443 either mod_ssl is loaded or not.

I wasn't sure if I had to explicitly tel the server to listen to 443. Do
I?

> than what you've tried from command line (namely 127.0.0.1 aka localhost).

146.169.4.13 is the real world IP for the machine I am running on, I have
tried connecting to localhost, 127.0.0.1, 146.169.3.14 and
stone.doc.ic.ac.uk (the FQDN of the host) but all have the same error ;-(

Laurie