Subject: Apache 2.0.* and SSL

From: Eli Marmor <[email-masked]>
Date: Fri, 05 Apr 2002 14:35:06 +0300

Hi mod_ssl users,

As most of you probably know, the development efforts of Apache 2 are
going to result in a product, soon. The current betas are already
stable, mature, fast, portable than ever, strong, and support many
features that we have dreamed about for years, like filtering (I
mention this feature, and not zillion others, because it is important
specifically for SSL).

Yes, it's true that some of us didn't like various things, and that the
development process was not optimal and took too much time.

But this effort comes (finally...) to a successful end, and I believe
that everybody who uses SSL (including myself...) should do the
migration.

Contrary to past versions, this one is a dramatic change in the
integration of SSL. No more patches, no more re-compilations with
"-DEAPI", no more 3rd party modules which cause Apache to crash because
these modules were not compiled using this flag, no more specific
versions of mod_ssl per each version of Apache, no more repeating
merges of the patches of mod_ssl.

Now, thanks to the filtering feature, mod_ssl is separate, and doesn't
depend on modifications in the core of Apache.

Thanks to the White House, mod_ssl is not a national secret that can't
be distributed, anymore.

Thanks to the USPTO, mod_ssl doesn't depend on a protected patent
anymore (it expired. RSA even gave up 2 weeks).

And thanks to ASF, mod_ssl is a standard part of Apache.

Any Apache that will be distributed in the future, will include SSL
support (at least optionally), that can be enabled externally by
installing OpenSSL and adding some directives to the httpd.conf.

Ben did a great job by creating apache_ssl.
Ralf did a great job too, by improving it, and his impressive efforts
and skills that were invested in developing and maintaining mod_ssl.
We all owe a great thank to Ralf for other Open Source projects that he
does, or joins.

Now it's time to make the next step, and migrate to Apache 2.0.
It still requires some work and testing.
It can happen if we all join this effort.
I am not a member of ASF, but I'm convinced that everybody will accept
you happily.

-- 
Eli Marmor
[email-masked]
CTO, Founder
Netmask (El-Mar) Internet Technologies Ltd.
__________________________________________________________
Tel.:   +972-9-766-1020          8 Yad-Harutzim St.
Fax.:   +972-9-766-1314          P.O.B. 7004
Mobile: +972-50-23-7338          Kfar-Saba 44641, Israel
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked] (George Walsh)
Date: Mon, 08 Apr 2002 15:23:10 -0400

OpenSSL is a separate issue, really. It is normally found in /usr/local/src. I am using 0.9.6c currently, which I download as a tar.gz to my /usr/local/src file, uncompress it with: gzip -dc openssl-0.9.6c.tar.gz | tar xf -
cd /usr/local/src/openssl-0.9.6c
./config shared
make all test install   ... and voila!

Apache 2.0 includes its own mod_ssl as part of the 'new look'. That gives you encryption while openssl gives you certification services.

FWIW I prefer to remove rpm installations for Apache, mod_ssl, mozilla, netscape, opera and sendmail so I can keep painlessly up-to-date. Its not everybody's cup of tea, but I've been doing it this way for years and I like the feeling of being 'in control' of these crucial elements.

Hope that helps ...

George

>What options are needed to "configure," with Apache 2.0, to make sure that
>mod_ssl is enabled, and that a particular OpenSSL directory is used?  I
>tried guessing at the right options, but a look at the httpd.conf file in
>the resulting installation suggests that I guessed wrong.
>
>Lynn Gazis

-- 
George Walsh,
Managing Director,
CruiseRoutes Division,
DSC Directional Services Corp
Courtenay, British Columbia, Canada

__________________________________________________________________
Your favorite stores, helpful shopping tools and great gift ideas. Experience the convenience of buying online with Shop@Netscape! http://shopnow.netscape.com/

Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

---

From: [email-masked] (George Walsh)
Date: Mon, 08 Apr 2002 17:32:45 -0400

Oh please, no, not another one .... I'm drowning just trying to keep up as it is, but that, as they say, is but one man's opinion. I know - I don't have to joi, but then the existing established groups might not be as representative as they would otherwise be.

George

>On Mon, 8 Apr 2002, Eli Marmor wrote:
>
>> I think that we should open a special mailing list for mod_ssl of
>> Apache2.
>
>My personal opinion would be that most modssl users' questions will be of
>the same nature regardless of version.  The kinds of questions we get
>here:
>
>   (1) why can't I use NBVH+SSL?
>   (2) how do I get my certificate created and/or to work
>   (3) I'm having problems getting IE to connect, what do I do?
>   (4) ...
>
>The answers to these questions are all the same regardless of whether
>you're talking about 1.3 or 2.0, and there will always be those of us on
>the httpd development team that listen in on modssl-users for potential
>bugs, so in my mind it makes sense to keep the user group as one.
>
>But that's just me... if you guys disagree, then go right ahead and create
>a new list.
>
>--Cliff
>
>--------------------------------------------------------------
>   Cliff Woolley
>   [email-masked]
>   Charlottesville, VA
>
>

---

From: [email-masked] (George Walsh)
Date: Mon, 08 Apr 2002 21:01:43 -0400

Very well said, Geoff.

I have 'played' with Apache 2.0 but certainly not with anything having to do with https and ssl. Now, with a heavy launch schedule in front of me, I have all I can do to switch people out of windows and into KDE/GNOME environments.

Respectfully,

George

Geoff Thorpe <[email-masked]> wrote:

>Hey there,
>
>On Tuesday 09 April 2002 10:18, you wrote:
>> Steve Gonzales wrote:
>> > One list is enough for me.  SSL theory doesn't change from 1.3.xx to
>> > 2.0.xx; only the configuration and installation changes.
>>
>> There are many other issues, like the "-DEAPI" and 3rd party modules
>> that cause Apache to crash.
>>
>> Anyway, the fact is that all of the discussions regarding 2.0 are done
>> in the new-httpd list, and not here (at least till this thread). So it
>> is clear that something must be done. Maybe a request to new-httpd
>> subscribers to move the SSL discussions to here?
>
>I would respectfully suggest that modssl discussions stay here. I don't want 
>to rag on Apache 2.0, and I'm sure a lot of good things have found their way 
>into it, but it does not solve a number of issues that I think many people in 
>production environments would require to push them into a pro-active decision 
>to migrate. Likewise, it introduces an entirely new base of code with 
>considerably less real-world mileage than the Apache 1.3.** base, so there's 
>a non-trivial motivation to *not* migrate unless absolutely necessary.
>
>Apache 2.0 has clearly also been taking what one might call an, ummm, let's 
>say "value-added" design approach. If your focus is on SSL/TLS, security, and 
>serving up HTML through a robust and secure server, then having something new 
>that tries to multiplex a huge number of different features and services (in 
>the same address-space as one another, moreover!) is a can of worms that many 
>people will consider best left shut. For now at the very least.
>
>So if discussion on the SSL module is in someways independant (or at least 
>may often be independant) of the apache version, I'd suggest we keep 
>discussion in this one place.
>
>For my own part; in the near future, I will be working again on session 
>caching and other tuning operations on the Apache 1.3.***-based modssl 
>distribution and [will] have neither the time nor inclination to involve 
>myself in the goings-on of Apache 2.0. I won't mind at *all* if someone who 
>does have the time and motivation handles merging anything useful from that 
>to the apache 2.0 code-base - but I won't be reading from, or posting to, 
>anything Apache 2.0-specific.
>
>Cheers,
>Geoff
>

---

From: Lynn Gazis <[email-masked]>
Date: Wed, 10 Apr 2002 14:11:44 -0700

An addendum to the second test (Apache 2.0.35 with SSL, on HP UX 11.0, no
attempt to use cryptographic accelerator): I found that I can connect to
this Web server with IE or Netscape, but attempting to connect with swamp
1.1.0 (using the -connect parameter and no others) results in the same error
message as I got from my own application and from OpenSSL's s_client.

Lynn Gazis

-----Original Message-----
From: Lynn Gazis [mailto:[email-masked]]
Sent: Tuesday, April 09, 2002 4:15 PM
To: [email-masked]'
Subject: RE: Apache 2.0.* and SSL

OK, I've tested it, and so far it isn't working for me.  Here are my tests:

1) Attempt to configure, on an HP UX 11.0 system, to use SSL with a
cryptographic accelerator card:

Set up Apache 1.3.23, on this same system, and confirmed that it ran and
successfully accessed the CryptoSwift card.

configure --enable-ssl --with-ssl=/home/lgazis/openssl-engine-0.9.6c
--prefix=/home/lgazis/apache2 --enable-rule=SSL_EXPERIMENTAL

Had to create lib directory under openssl-engine-0.9.6c and copy libraries
there, since they seemed to be expected there rather than at the top level.

First problem: http://httpd.apache.org/docs-2.0/install.html makes no
mention of actually installing a certificate, and "make certificate" appears
to no longer be the correct thing to do.

Worked around this by copying conf/ssl.crt and conf/ssl.key from Apache
1.3.23 installation to Apache 2.0.35 installation.

Edited httpd.conf, set ServerName to pamela, User to www, Group to nobody,
Listen to my IP address and port.  Edited ssl.conf and set Listen to my IP
address and port, and added "SSLCryptoDevice cswift".

Attempted a "bin/apachectl startssl", and got the error: "Invalid command
'SSLCryptoDevice'...".  Evidently something has changed, since Apache 1.3,
about how to make the cryptographic accelerators in the OpenSSL engine code
work.

2) Test, on HP UX 11.0 system, attempting to use SSL and no cryptographic
accelerator.

Got rid of the SSLCryptoDevice line, and tested to see whether I could make
Apache 2.0 work with SSL with no accelerator.  This also failed; the server
started, but when I generated traffic, none of my handshakes succeeded, and
my error log showed lots of "[error] [client 10.10.37.185] Invalid method in
request k".

Tried a test with OpenSSL's s_client, instead of my own test program,
generating the traffic.  Ran s_client with the -connect option, and no
others.  Got the error:

warning, not much extra random data, consider using the -rand option
CONNECTED(00000003)
905:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:460

Attempts to specify with ssl3 or tls1 also failed to connect, though with a
different error.

3) Attempted to build Apache 2.0 on Solaris 7:

Configured with same options as on the HP system, but my make failed with an
undefined symbol sk_new_null.

Either this isn't working properly, or I am missing some key information
about how I am supposed to be setting this up.  I've been building and
running various versions of Apache 1.3 on these same systems with no
difficulty.

Lynn Gazis

-----Original Message-----
From: Cliff Woolley [mailto:[email-masked]]
Sent: Tuesday, April 09, 2002 8:03 AM
To: [email-masked]
Subject: Re: Apache 2.0.* and SSL

On Tue, 9 Apr 2002, Mads Toftum wrote:

> I too could add a whole lot of reasons to not migrate if you're doing SSL.
> Up to about a week before Apache went GA, there were substantial commits
to
> SSL code which to me makes it an essentially untested module.

While I can't wholly disagree with you, I will point out that the only way
we can ever really consider SSL "tried and true" is if the people
_from_this_group_ test it extensively and help us find the problems with
it.  Your participation is vital... really!

Thanks all,
Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Apache HTTP Server Project