Subject: Problem starting apache with ssl mod_ssl

From: [email-masked]
Date: Mon, 8 Apr 2002 13:52:23 +0300

Sory with the first attempt samthing went wrong

greetings to everyone

i have the following problem and it will be very nice of you if you could help me out with this!
in one redhat7.2 i have installed apache/php/ssl/mod_ssl as it can be seen at the end of my mail
In the httpd.conf i have put the following: 

*httpd.conf*

<IfDefine SSL>
Listen 80
Listen 599
</IfDefine>

<IfDefine SSL>
<VirtualHost 195.130.109.84:599>
DocumentRoot "/usr/local/apache/htdocs"
ServerName asterix.cs.teiath.gr
ServerAdmin [email-masked]
ErrorLog /usr/local/apache/logs/asterix_SSL_error_log
TransferLog /usr/local/apache/logs/asterix_SSL_access_log
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/local/apache/conf/keys/asterix.cs.teiath.gr/server.crt
SSLCertificateKeyFile /usr/local/apache/conf/keys/asterix.cs.teiath.gr/server.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/local/apache/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog /usr/local/apache/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
</IfDefine>

when i run /usr/local/apache/bin/apactrl  startssl
in the error.log are written the following:

*log from error.log*

[Mon Apr  8 03:59:26 2002] [notice] Apache/1.3.24 (Unix) PHP/4.1.2 mod_gzip/1.3.19.1a DAV/1.0.3
mod_ssl/2.8.8 OpenSSL/0.9.6b configured -- resuming normal operations
[Mon Apr  8 03:59:26 2002] [notice] suEXEC mechanism enabled (wrapper: /usr/local/apache/bin/sue
xec)
[Mon Apr  8 03:59:26 2002] [notice] Accept mutex: sysvsem (Default: sysvsem)

and in the ssl_engine_log the following:

*log from ssl_engine_log*

[08/Apr/2002 04:15:35 29986] [info]  Server: Apache/1.3.24, Interface: mod_ssl/2.8.8, Library: OpenSSL/0.9.6b
[08/Apr/2002 04:15:35 29986] [info]  Init: 1st startup round (still not detached)
[08/Apr/2002 04:15:35 29986] [info]  Init: Initializing OpenSSL library
[08/Apr/2002 04:15:35 29986] [info]  Init: Loading certificate & private key of SSL-aware server asterix.cs.teiath.gr:599
[08/Apr/2002 04:15:35 29986] [info]  Init: Requesting pass phrase via builtin terminal dialog
[08/Apr/2002 04:15:39 29986] [info]  Init: Wiped out the queried pass phrases from memory
[08/Apr/2002 04:15:39 29986] [info]  Init: Seeding PRNG with 136 bytes of entropy
[08/Apr/2002 04:15:39 29986] [info]  Init: Generating temporary RSA private keys (512/1024 bits)
[08/Apr/2002 04:15:41 29986] [info]  Init: Configuring temporary DH parameters (512/1024 bits)
[08/Apr/2002 04:15:41 29987] [info]  Init: 2nd startup round (already detached)
[08/Apr/2002 04:15:41 29987] [info]  Init: Reinitializing OpenSSL library
[08/Apr/2002 04:15:41 29987] [info]  Init: Seeding PRNG with 136 bytes of entropy
[08/Apr/2002 04:15:41 29987] [info]  Init: Configuring temporary RSA private keys (512/1024 bits)
[08/Apr/2002 04:15:41 29987] [info]  Init: Configuring temporary DH parameters (512/1024 bits)
[08/Apr/2002 04:15:41 29987] [info]  Init: Initializing (virtual) servers for SSL
[08/Apr/2002 04:15:41 29987] [info]  Init: Configuring server asterix.cs.teiath.gr:599 for SSL protocol

when now i try through a browser https://asterix.cs.teiath.gr:599
nothing is happening
i receive from netscape "server not response"

then i try the following
curl https://asterix.cs.teiath.gr:599
and it produces in the ssl_engine_log the following

[08/Apr/2002 04:36:36 29988] [info]  Connection to child 0 established (server asterix.cs.teiath.gr:599, client 195.130.109.84)
[08/Apr/2002 04:36:36 29988] [info]  Seeding PRNG with 23177 bytes of entropy
[08/Apr/2002 04:36:37 29988] [info]  Connection: Client IP: 195.130.109.84, Protocol: TLSv1, Cipher: EDH-RSA-DES-CBC3-SHA (168/168 bits)
[08/Apr/2002 04:36:37 29988] [info]  Initial (No.1) HTTPS request received for child 0 (server asterix.cs.teiath.gr:599)
[08/Apr/2002 04:36:37 29988] [info]  Connection to child 0 closed with standard shutdown (server asterix.cs.teiath.gr:599, client 195.130.109.84)

that it means to me,if i get it right, that it works
when i trythe same curl https://asterix.cs.teiath.gr:599
from a different machine
i receive 
curl: (7) connect() failed

have you any idea what might be wrong?

i apologise for my huge mail and i thank you for your time.
Apostolis

PS

APACHE AND PHP CONFIG

PHP config
'--enable-exif' '--enable-track-vars' '--with-calendar=shared' '--enable-safe-mode' '--enable-magic-quotes' '--enable-trans-sid' '--enable-wddx' '--enable-ftp' 
'--with-gd=/usr/local' '--with-zlib' '--enable-gd-native-tt' '--with-t1lib=/usr/local' '--with-jpeg-dir=/usr' '--with-png-dir=/usr' '--with-zlib-dir=/usr' '--with-ttf' 
'--with-freetype-dir=/usr/local' '--with-imap=/usr/local' '--with-mhash=/usr/local' '--with-mcrypt=/usr/local' '--with-unixodbc=/usr/local/unixODBC' 
'--with-snmp=/usr/local/snmp' '--with-openssl=/usr' '--with-gettext=/usr' '--with-mysql=/usr' '--with-pgsql' '--with-ldap' '--with-mm' '--with-mcal=/usr/local/libmcal' 
'--with-db3=/usr'

APACHE MODULES
mod_php4, mod_gzip, mod_dav, mod_auth_ldap, mod_ssl, mod_setenvif, mod_so, mod_headers, mod_digest, mod_auth_dbm, mod_auth, mod_access, mod_rewrite, 
mod_alias, mod_userdir, mod_speling, mod_actions, mod_imap, mod_asis, mod_cgi, mod_dir, mod_autoindex, mod_include, mod_status, mod_negotiation, mod_mime, 
mod_log_referer, mod_log_agent, mod_log_config, mod_env, mod_vhost_alias, mod_mmap_static, http_core
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Wed, 10 Apr 2002 12:57:39 +0300

Dear all
Please help me. I'm getting very desparate. 
Hasn't anyone faced this problem before??
I don't know what else to try.

Αρχικό μήνυμα από  [email-masked]:

> SSLCipherSuite
> ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> SSLCertificateFile
> /usr/local/apache/conf/keys/asterix.cs.teiath.gr/server.crt
> SSLCertificateKeyFile
> /usr/local/apache/conf/keys/asterix.cs.teiath.gr/server.key
> [08/Apr/2002 04:15:35 29986] [info]  Init: Loading certificate & private key
> of SSL-aware server asterix.cs.teiath.gr:599
> [08/Apr/2002 04:15:41 29987] [info]  Init: Configuring server
> asterix.cs.teiath.gr:599 for SSL protocol
> 
> [08/Apr/2002 04:36:36 29988] [info]  Connection to child 0 established
> (server asterix.cs.teiath.gr:599, client 195.130.109.84)
> [08/Apr/2002 04:36:37 29988] [info]  Connection: Client IP: 195.130.109.84,
> Protocol: TLSv1, Cipher: EDH-RSA-DES-CBC3-SHA (168/168 bits)
> [08/Apr/2002 04:36:37 29988] [info]  Initial (No.1) HTTPS request received
> for child 0 (server asterix.cs.teiath.gr:599)
> [08/Apr/2002 04:36:37 29988] [info]  Connection to child 0 closed with
> standard shutdown (server asterix.cs.teiath.gr:599, client 195.130.109.84)
> 
> '--enable-exif' '--enable-track-vars' '--with-calendar=shared'
> '--enable-safe-mode' '--enable-magic-quotes' '--enable-trans-sid'
> '--enable-wddx' '--enable-ftp' 
> '--with-gd=/usr/local' '--with-zlib' '--enable-gd-native-tt'
> '--with-t1lib=/usr/local' '--with-jpeg-dir=/usr' '--with-png-dir=/usr'
> '--with-zlib-dir=/usr' '--with-ttf' 
> '--with-freetype-dir=/usr/local' '--with-imap=/usr/local'
> '--with-mhash=/usr/local' '--with-mcrypt=/usr/local'
> '--with-unixodbc=/usr/local/unixODBC' 
> '--with-snmp=/usr/local/snmp' '--with-openssl=/usr' '--with-gettext=/usr'
> '--with-mysql=/usr' '--with-pgsql' '--with-ldap' '--with-mm'
> '--with-mcal=/usr/local/libmcal' 
> '--with-db3=/usr'
> 
> APACHE MODULES
> mod_php4, mod_gzip, mod_dav, mod_auth_ldap, mod_ssl, mod_setenvif, mod_so,
> mod_headers, mod_digest, mod_auth_dbm, mod_auth, mod_access, mod_rewrite, 
> mod_alias, mod_userdir, mod_speling, mod_actions, mod_imap, mod_asis,
> mod_cgi, mod_dir, mod_autoindex, mod_include, mod_status, mod_negotiation,
> mod_mime,

---

From: Owen Boyle <[email-masked]>
Date: Wed, 10 Apr 2002 12:15:06 +0200

> > asterix.cs.teiath.gr:599 for SSL protocol

This indicates that SSL is starting properly.

> > that it means to me,if i get it right, that it works

This confirms the server is OK. You can access it from the same
machine...

> > i receive from netscape "server not response"

So you cannot connect across a network....

Questions:

- do you get anything in the SSL log when you try to connect from across
the network? If not -> packets are not reaching server.

- to confirm, try "# snoop port 599" to see if there is any traffic at
the network layer.

- do other network services work across the network (plain HTTP, telnet
etc.)? If not -> network problem.

- I notice you want to use port 599. Is there a firewall, bridge or
router in between the client and server which might be configured to
drop packets on such an unusual port?

- is it possible to try SSL on port 443 (which is standard)?

Rgds,

Owen Boyle.