Subject: How do I check to see if it works?

From: Søren Neigaard <[email-masked]>
Date: Mon, 18 Feb 2002 10:28:49 +0100

I'm having some problems with my router, so I'm not sure where my
problem is, in the router or in my httpd.conf

If I do a portscan of my machine, port 443 return stealth. But it
should be open. Can port 443 return stealth because there is no server
listening, or is it because it is closed?

Anyway I have attached a snippet from my httpd.conf, where I have
tried to adjust the example to my needs. Now I was hoping you guys
could tell me if it look ok. It looks like this:

<IfDefine SSL>
<VirtualHost 192.168.1.4:443>
DocumentRoot "/usr/local/www/data"
ServerName ssl.duketech.net
ServerAdmin [email-masked]
ErrorLog /var/log/httpd-error.log
TransferLog /var/log/httpd-access.log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/local/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog /var/log/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>                                  
</IfDefine>

What is the <Files>, <Directory> and SetEnvIf used for?

How should I be able to request my page?

Hope you can help me :)

--
Med venlig hilsen/Best regards,
 Søren Neigaard mailto:[email-masked]
--
 "There are two ways to write error-free programs; only the third one works."

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Mon, 18 Feb 2002 12:04:31 +0100

> problem is, in the router or in my httpd.conf
First look in your error_log from apache.

> listening, or is it because it is closed?
netstat -an|grep 443 locally on the machine or 
openssl s_client -connect 192.168.1.4:443

>           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
You need the SSLCertificateFile and SSLCertificateKeyFile directives too -
http://www.modssl.org/docs/2.8/ssl_reference.html#ToC10
http://www.modssl.org/docs/2.8/ssl_reference.html#ToC11

> What is the <Files>, <Directory> and SetEnvIf used for?
See http://httpd.apache.org/docs/

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Søren Neigaard <[email-masked]>
Date: Mon, 18 Feb 2002 13:54:36 +0100

Monday, February 18, 2002, 12:04:31 PM, Mads wrote:

>> problem is, in the router or in my httpd.conf
MT> First look in your error_log from apache.

It doesn't get hit. Should I not be able to connect to my SSL site by
trying ssl.duketech.net in my browser?

>> listening, or is it because it is closed?
MT> netstat -an|grep 443 locally on the machine or

Returns nothing.

MT> openssl s_client -connect 192.168.1.4:443

Gives:

connect: Connection refused
connect:errno=61

>>           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
MT> You need the SSLCertificateFile and SSLCertificateKeyFile directives too -
Ok I have those now.

---

From: Søren Neigaard <[email-masked]>
Date: Tue, 19 Feb 2002 21:19:31 +0100

Returns nothing.

Gives:

---

From: Thomas Binder <[email-masked]>
Date: Wed, 20 Feb 2002 13:44:09 +0100

Hi!

On Mon, Feb 18, 2002 at 10:28:49AM +0100, Søren Neigaard wrote:
> [...]

Have you also got something like

Listen 443

or

Listen 192.168.1.4:443

in your httpd.conf? It's not enough to specify IP addresses and
ports in <VirtualHost>, you also explicitly have to make Apache
listen on those adresses and ports. By default, Apache will only
listen on *:80

Ciao

Thomas

-- 
bureaucrat, n:
	A politician who has tenure.

---

From: Søren Neigaard <[email-masked]>
Date: Wed, 20 Feb 2002 21:46:39 +0100

Wednesday, February 20, 2002, 1:44:09 PM, Thomas wrote:

TB> Hi!

>> <VirtualHost 192.168.1.4:443>

TB> Have you also got something like
TB> Listen 443

TB> or

TB> Listen 192.168.1.4:443

TB> in your httpd.conf? It's not enough to specify IP addresses and
TB> ports in <VirtualHost>, you also explicitly have to make Apache
TB> listen on those adresses and ports. By default, Apache will only
TB> listen on *:80

I have the following:

Port 80
<IfDefine SSL>
Listen 80
Listen 443
</IfDefine>

Why do I have dublicats of port 80?

Do you even think my module is installed correctly, can I check this?

---

From: Thomas Binder <[email-masked]>
Date: Thu, 21 Feb 2002 10:58:10 +0100

Hi!

On Wed, Feb 20, 2002 at 09:46:39PM +0100, Søren Neigaard wrote:
> TB> in your httpd.conf?

See http://httpd.apache.org/docs/mod/core.html#port

Thus, the Port command is effectively ignored.

> Do you even think my module is installed correctly, can I check

How do you run Apache when you want it to support SSL, i.e. which
command do you use? You have read mod_ssl's documentation, haven't
you?

Ciao

Thomas

-- 
Our OS who art in CPU, UNIX be thy name.
	Thy programs run, thy syscalls done,
	In kernel as it is in user!
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Søren Neigaard <[email-masked]>
Date: Fri, 22 Feb 2002 18:04:17 +0100

Thursday, February 21, 2002, 10:58:10 AM, Thomas wrote:

TB> How do you run Apache when you want it to support SSL, i.e. which
TB> command do you use? You have read mod_ssl's documentation, haven't
TB> you?

Oh.... Didn't see that one, actually I haven't found it yet in the
docs, but I just found "/usr/local/apache/bin/httpd -DSSL" in the
examples :)

Thx :)