Subject: RE: Apache 2.0.* and SSL

From: Lynn Gazis <[email-masked]>
Date: Mon, 8 Apr 2002 11:49:37 -0700

What options are needed to "configure," with Apache 2.0, to make sure that
mod_ssl is enabled, and that a particular OpenSSL directory is used?  I
tried guessing at the right options, but a look at the httpd.conf file in
the resulting installation suggests that I guessed wrong.

Lynn Gazis
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Charles Aulds <[email-masked]>
Date: Mon, 8 Apr 2002 14:17:59 -0500

> the resulting installation suggests that I guessed wrong.

This is what I use:

./configure \
"--with-layout=Apache" \
"--enable-mods-shared=all" \
"--enable-ssl" 

( Apache/2.0.35 (Unix) mod_ssl/2.0.35 OpenSSL/0.9.6b DAV/2 mod_perl/1.99_01-dev Perl/v5.6.0 PHP/4.1.2 )

__
Charles Aulds
http://hiwaay.net/~caulds/

---

From: Eli Marmor <[email-masked]>
Date: Mon, 08 Apr 2002 23:26:32 +0300

By the way:

I think that we should open a special mailing list for mod_ssl of
Apache2.

The current list focuses on 1.3, which is completely different than 2,
and even comes in a very different way (as a patch, rather than a
filter). The developers and maintainers are different. And the new
mod_ssl is a part of Apache.

On the other hand, the main list that currently deals with the new
mod_ssl, is new_httpd, which is the main list of Apache developers: It
deals with zillion things, very heavy, and doesn't focus on SSL at all.

There must be a third list, specific for mod_ssl of 2.0.

It must be announced to both of the current lists, so subscribers of
both have chance to subscribe to the new list (I guess that in most of
the cases it will be IN ADDITION to their current list, and not instead
of it).

I don't know if it should be served by the server of the other lists of
Apache, or by Ralf's server; I guess that we should ask Ralf...

-- 
Eli Marmor
[email-masked]
CTO, Founder
Netmask (El-Mar) Internet Technologies Ltd.
__________________________________________________________
Tel.:   +972-9-766-1020          8 Yad-Harutzim St.
Fax.:   +972-9-766-1314          P.O.B. 7004
Mobile: +972-50-23-7338          Kfar-Saba 44641, Israel
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 8 Apr 2002 16:34:12 -0400 (EDT)

> I think that we should open a special mailing list for mod_ssl of

My personal opinion would be that most modssl users' questions will be of
the same nature regardless of version.  The kinds of questions we get
here:

   (1) why can't I use NBVH+SSL?
   (2) how do I get my certificate created and/or to work
   (3) I'm having problems getting IE to connect, what do I do?
   (4) ...

The answers to these questions are all the same regardless of whether
you're talking about 1.3 or 2.0, and there will always be those of us on
the httpd development team that listen in on modssl-users for potential
bugs, so in my mind it makes sense to keep the user group as one.

But that's just me... if you guys disagree, then go right ahead and create
a new list.

--Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Charlottesville, VA

---

From: Gary W <[email-masked]>
Date: Mon, 08 Apr 2002 13:36:40 -0700

I am getting a timeout error, from not
reading all the bytes from the client(?).
The client can talk to retrieve the jar file,
but when it sends an RMI, it balks.
I obviously have 8443 open for SSL, and my certs
must be OK. Is it a client problem?
Is it even related to mod_ssl (someone in the
openssl list said to post it here)?

On Solaris 2.6 server:
Server: Apache/1.3.14, Interface: mod_ssl/2.7.1, Library: OpenSSL/0.9.6

(this is the jar download - it works over port 8443)
[04/Apr/2002 09:01:00 29031] [info]  Connection to child 0 established
(server x:8443, client x)
[04/Apr/2002 09:01:01 29031] [info]  Seeding PRNG with 1160 bytes of
entropy
[04/Apr/2002 09:01:01 29031] [trace] OpenSSL: Handshake: start
[04/Apr/2002 09:01:02 29031] [trace] OpenSSL: Loop: before/accept
initialization
[04/Apr/2002 09:01:02 29031] [debug] OpenSSL: read 11/11 bytes from
BIO#0021FE88 [mem: 00234C20] (BIO dump follows)
+-------------------------------------------------------------------------+
| 0000: 80 46 01 03 00 00 2d 00-00 00 10                
.F....-....      |
+-------------------------------------------------------------------------+
[04/Apr/2002 09:01:02 29031] [debug] OpenSSL: read 61/61 bytes from
BIO#0021FE88 [mem: 00234C2B] (BIO dump follows)
+-------------------------------------------------------------------------+
...
+-------------------------------------------------------------------------+
[04/Apr/2002 09:01:02 29031] [trace] OpenSSL: Loop: SSLv3 read client
hello A
[04/Apr/2002 09:01:02 29031] [trace] OpenSSL: Loop: SSLv3 write server
hello A
[04/Apr/2002 09:01:03 29031] [trace] OpenSSL: Loop: SSLv3 write
certificate A
[04/Apr/2002 09:01:03 29031] [trace] OpenSSL: Loop: SSLv3 write server
done A
[04/Apr/2002 09:01:03 29031] [debug] OpenSSL: write 937/937 bytes to
BIO#0021FE88 [mem: 00242048] (BIO dump follows)
+-------------------------------------------------------------------------+
...

[04/Apr/2002 09:01:40 29031] [debug] OpenSSL: write 23/23 bytes to
BIO#0021FE88 [mem: 0023D430] (BIO dump follows)
+-------------------------------------------------------------------------+
...
+-------------------------------------------------------------------------+
[04/Apr/2002 09:01:40 29031] [trace] OpenSSL: Write: SSL negotiation
finished successfully
[04/Apr/2002 09:01:40 29031] [info]  Connection to child 0 closed with
standard shutdown (server x:8443, client x)

(this RMI call fails)

[03/Apr/2002 08:11:48 29033] [info]  Connection to child 2 established
(server  <removed>:8443, client  <removed>)
[03/Apr/2002 08:11:48 29033] [info]  Seeding PRNG with 1160 bytes of
entropy
[03/Apr/2002 08:11:48 29033] [trace] OpenSSL: Handshake: start
[03/Apr/2002 08:11:48 29033] [trace] OpenSSL: Loop: before/accept
initialization
[03/Apr/2002 08:11:48 29033] [debug] OpenSSL: read 7/11 bytes from
BIO#00242AA8 [mem: 00237C38] (BIO dump follows)
+-------------------------------------------------------------------------+
| 0000: 4a 52 4d 49 00 02 4b                            
JRMI..K          |
+-------------------------------------------------------------------------+
[03/Apr/2002 08:12:10 29033] [debug] OpenSSL: I/O error, 4 bytes
expected to read on BIO#00242AA8 [mem: 00237C3F]
[03/Apr/2002 08:12:10 29033] [trace] OpenSSL: Exit: error in SSLv2/v3
read client hello A
[03/Apr/2002 08:12:10 29033] [error] SSL handshake timed out (client
171.64.70.217, server 

Gary Wesley

---

From: "Steve Gonzales" <[email-masked]>
Date: Mon, 8 Apr 2002 16:45:01 -0500

One list is enough for me.  SSL theory doesn't change from 1.3.xx to
2.0.xx; only the configuration and installation changes.

Steve Gonzales
Louisiana State University		[email-masked]
Division of Engineering Services	225.578.6069 (v)
3216G CEBA					225.578.5990 (f)
Baton Rouge, LA  70803

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Cliff Woolley
Sent: Monday, April 08, 2002 3:34 PM
To: [email-masked]
Subject: Re: Apache 2.0.* and SSL

> I think that we should open a special mailing list for mod_ssl of 

My personal opinion would be that most modssl users' questions will be
of the same nature regardless of version.  The kinds of questions we get
here:

But that's just me... if you guys disagree, then go right ahead and
create a new list.

--Cliff

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 8 Apr 2002 17:49:16 -0400 (EDT)

> 2.0.xx; only the configuration and installation changes.

And even that is mostly the same.  :)

---

From: Eli Marmor <[email-masked]>
Date: Tue, 09 Apr 2002 01:18:29 +0300

> 2.0.xx; only the configuration and installation changes.

There are many other issues, like the "-DEAPI" and 3rd party modules
that cause Apache to crash. 

Anyway, the fact is that all of the discussions regarding 2.0 are done
in the new-httpd list, and not here (at least till this thread). So it
is clear that something must be done. Maybe a request to new-httpd
subscribers to move the SSL discussions to here?

---

From: Geoff Thorpe <[email-masked]>
Date: Tue, 9 Apr 2002 12:52:26 +1200

Hey there,

> subscribers to move the SSL discussions to here?

I would respectfully suggest that modssl discussions stay here. I don't want 
to rag on Apache 2.0, and I'm sure a lot of good things have found their way 
into it, but it does not solve a number of issues that I think many people in 
production environments would require to push them into a pro-active decision 
to migrate. Likewise, it introduces an entirely new base of code with 
considerably less real-world mileage than the Apache 1.3.** base, so there's 
a non-trivial motivation to *not* migrate unless absolutely necessary.

Apache 2.0 has clearly also been taking what one might call an, ummm, let's 
say "value-added" design approach. If your focus is on SSL/TLS, security, and 
serving up HTML through a robust and secure server, then having something new 
that tries to multiplex a huge number of different features and services (in 
the same address-space as one another, moreover!) is a can of worms that many 
people will consider best left shut. For now at the very least.

So if discussion on the SSL module is in someways independant (or at least 
may often be independant) of the apache version, I'd suggest we keep 
discussion in this one place.

For my own part; in the near future, I will be working again on session 
caching and other tuning operations on the Apache 1.3.***-based modssl 
distribution and [will] have neither the time nor inclination to involve 
myself in the goings-on of Apache 2.0. I won't mind at *all* if someone who 
does have the time and motivation handles merging anything useful from that 
to the apache 2.0 code-base - but I won't be reading from, or posting to, 
anything Apache 2.0-specific.

Cheers,
Geoff

---

From: Mads Toftum <[email-masked]>
Date: Tue, 9 Apr 2002 09:27:30 +0200

> subscribers to move the SSL discussions to here?
User discussion/support was never welcome on new-httpd, so I'm sure that
at least the user part of modssl discussions won't stay there.

vh

Mads Toftum
-- 
With a rubber duck, one's never alone.
              -- "The Hitchhiker's Guide to the Galaxy"
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Mon, 8 Apr 2002 20:58:14 +0200

> the resulting installation suggests that I guessed wrong.
The relevant stuff is:
  --enable-ssl            SSL/TLS support (mod_ssl)
  --with-ssl=DIR          SSL/TLS toolkit (OpenSSL)
(you can get a list of options with ./configure --help)

vh

Mads Toftum

---

From: Mads Toftum <[email-masked]>
Date: Mon, 8 Apr 2002 22:50:36 +0200

> the same nature regardless of version.  The kinds of questions we get
I agree. 

vh

Mads Toftum

---

From: Mads Toftum <[email-masked]>
Date: Tue, 9 Apr 2002 09:20:04 +0200

> a non-trivial motivation to *not* migrate unless absolutely necessary.

I too could add a whole lot of reasons to not migrate if you're doing SSL.
Up to about a week before Apache went GA, there were substantial commits to
SSL code which to me makes it an essentially untested module.
MAJOR CHANGES lists a substantial number of things that IMHO needs a load
of testing and ideally also some code review.  A look at the readme file 
also shows a substantial number of TODOs. modules/ssl/README is worth a look
for anyone thinking about a migration.

vh

Mads Toftum

---

From: Cliff Woolley <[email-masked]>
Date: Tue, 9 Apr 2002 11:03:28 -0400 (EDT)

> SSL code which to me makes it an essentially untested module.

While I can't wholly disagree with you, I will point out that the only way
we can ever really consider SSL "tried and true" is if the people
_from_this_group_ test it extensively and help us find the problems with
it.  Your participation is vital... really!

Thanks all,
Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Apache HTTP Server Project

---

From: Eli Marmor <[email-masked]>
Date: Tue, 09 Apr 2002 18:48:47 +0300

> it.  Your participation is vital... really!

This, exactly, was one of my intentions when I opened this thread.

BTW: Great article about 2.0, Cliff!  (IIRC, it was Linux Magazine).

---

From: Cliff Woolley <[email-masked]>
Date: Tue, 9 Apr 2002 12:45:05 -0400 (EDT)

> This, exactly, was one of my intentions when I opened this thread.

Glad to hear it.  :)

> BTW: Great article about 2.0, Cliff!  (IIRC, it was Linux Magazine).

Thanks!  It's good to know that people got something out of it.

<shameless plug> PS: for anyone else who's interested but missed it, it
just recently became available online at linux-mag.com.</shameless plug>

--Cliff

---

From: Mads Toftum <[email-masked]>
Date: Tue, 9 Apr 2002 20:18:17 +0200

> it.  Your participation is vital... really!
Exactly.
That was the point I wanted to make - that the new SSL code needs extensive
testing. I must admit that I was rather surprised when Apache went GA last
friday, I had expected another month at the very least to start looking
closer at it. Oh well, time to start testing :)

vh

Mads Toftum