Subject: Apache mod_ssl hanging browser

From: "Peter Cronin" <[email-masked]>
Date: Thu, 27 Jun 2002 11:53:33 -0400

Was wondering if anyone can help me? I believe I have mod_ssl loaded correctly and configurd correctly, but I get the following situation when I access my SSL site. 
- https://secure.aebdemo.com, it just hangs on site, but says host contacted...
- this is what the SSL.log says: It looks like it confgures ok for secure.aebdemo.com:443

[26/Jun/2002 22:01:53 02320] [info] Init: Configuring server secure.aebdemo.com:443 for SSL protocol

[26/Jun/2002 22:01:53 02404] [info] Server: Apache/1.3.26, Interface: mod_ssl/2.8.9, Library: OpenSSL/0.9.6d

[26/Jun/2002 22:01:53 02404] [warn] You are using mod_ssl under Win32. This combination is *NOT* officially supported. Use it at your own risk!

[26/Jun/2002 22:01:53 02404] [info] Init: 1st startup round (still not detached)

[26/Jun/2002 22:01:53 02404] [info] Init: Initializing OpenSSL library

[26/Jun/2002 22:01:53 02404] [info] Init: Loading certificate & private key of SSL-aware server secure.aebdemo.com:443

[26/Jun/2002 22:01:53 02404] [info] Init: Seeding PRNG with 136 bytes of entropy

[26/Jun/2002 22:01:53 02404] [info] Init: Generating temporary RSA private keys (512/1024 bits)

[26/Jun/2002 22:01:53 02404] [info] Init: Configuring temporary DH parameters (512/1024 bits)

[26/Jun/2002 22:01:53 02404] [info] Init: Seeding PRNG with 136 bytes of entropy

[26/Jun/2002 22:01:53 02404] [info] Init: Configuring temporary RSA private keys (512/1024 bits)

[26/Jun/2002 22:01:53 02404] [info] Init: Configuring temporary DH parameters (512/1024 bits)

[26/Jun/2002 22:01:53 02404] [info] Init: Initializing (virtual) servers for SSL

[26/Jun/2002 22:01:53 02404] [info] Init: Configuring server secure.aebdemo.com:443 for SSL protocol

[26/Jun/2002 22:02:02 02404] [info] Connection to child 0 established (server secure.aebdemo.com:443, client 205.229.222.70)

[26/Jun/2002 22:02:02 02404] [info] Seeding PRNG with 0 bytes of entropy

My current configuration is:
Windows 2000 SP2
Apache 1.3.26
mod_ssl 2.8.9
openssl .0.9.6d

my configuration in httpd.conf is:
SSLMutex sem
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLSessionCache none
SSLLog logs/SSL.log
SSLLoglevel info

NameVirtualHost 205.229.222.9:443

<VirtualHost 205.229.222.9:443>
Port 443
ServerName secure.aebdemo.com
DocumentRoot d:/data/lm
ErrorLog logs/secureaeb-error_log
CustomLog logs/secureaeb-access_log combined
SSLEngine On
SSLCertificateFile conf/ssl/secure.aebdemo.com.cert
SSLCertificateKeyFile conf/ssl/secure.aebdemo.com.key
</VirtualHost>

Any help would be appreciated.

Peter S. Cronin
Plexsys Technologies, Inc
http://www.psconcepts.com
732-280-9550

---

From: Geoff Thorpe <[email-masked]>
Date: Thu, 27 Jun 2002 15:55:54 -0400 (EDT)

Hi,

On Thu, 27 Jun 2002, Peter Cronin wrote:

> Was wondering if anyone can help me? I believe I have mod_ssl loaded
> correctly and configurd correctly, but I get the following situation
> when I access my SSL site.

[snip]

> [26/Jun/2002 22:02:02 02404] [info] Seeding PRNG with 0 bytes of entropy

[snip]

> SSLRandomSeed connect builtin

[snip]

It would appear you may have a PRNG problem, and given that you're running
on some variant of windows, it wouldn't surprise me in the least. I don't
know much (read: anything) about mod_ssl's operation under win32, but one
way for you to find out *if* this what's causing your problems, try using
some largish file (eg. 32Kb or bigger should certainly be enough) and
feeding that into SSLRandomSeed, ie. replace "builtin" in both of those
lines with "file:<path-to-your-file>".

If that works, don't leave it like that as it represents a security risk.
However, it would at least tell you if a working source of entropy for the
PRNG is all that separates you from a functioning system, otherwise the
problem lies elsewhere. As for a working PRNG solution on windows that you
*could* use in production ... good question ... you may want to ask that
separately on this list as/when you know if it's the problem. Lutz is on
this list, he'd have a better chance of answering such a question than I.

Cheers,
Geoff

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]