Subject: Error message help

From: Matt Nelson <[email-masked]>
Date: Tue, 30 Jul 2002 23:13:15 -0500

Hi all, I'm new to the list and to mod_ssl, and well ssl in general, so I 
hope you'll forgive what may be dumb questions.

I've been tasked with setting up a ssl site for a small company that wants 
to sell online.  I've never done anything other than plain sites before, so 
I'm having to learn.   I've done what all the docs have told me to, as near 
as I can tell, and I've gotten pretty far along.  I'm still fuzzy on the 
exact syntax of the directives, but I've gotten it nearly working I 
think.  This is all being done on a stock Caldera 3.11 server box.

Now, the error I'm getting now  that I can't seem to find any help on, in 
the error_log is:

OpenSSL: error:0D06B078:asn1 encoding routines:ASN1_get_object:header too long

I've googled on it, and searched FAQ's, etc, and nothing of help has appeared.

I'd appreciate some help on this, I hate when I can't find help in the 
docs, I hate having to bother anyone.

Thanks

--
Matt

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Boyle Owen" <[email-masked]>
Date: Wed, 31 Jul 2002 15:56:52 +0200

>From: Matt Nelson [mailto:[email-masked]]
>

Unusual.. Do you see anything in the browser? Also:

- What versions of apache, mod_ssl, openssl?
- Static or DSO?
- What browser?

Rgds,
owen Boyle

---

From: Matt Nelson <[email-masked]>
Date: Wed, 31 Jul 2002 09:36:14 -0500

>- What versions of apache, mod_ssl, openssl?

Apache 1.3.22
OpenSSL 0.9.6
mod_ssl 1.4

>- Static or DSO?

I'll be honest and say I don't quite understand that question.  I'm way 
more new at this what I wished.  I could probably answer that question, if 
asked in different terms.

>- What browser?

IE, Mozilla, you name it.

---

From: Matt Nelson <[email-masked]>
Date: Wed, 31 Jul 2002 10:01:18 -0500

Well I may have figured this out, https is now running, cert was in the 
wrong place, but https returns the default web page for the apache 
installation, instead of the real site, which does come up with just 
http.  I think I can figure that out, but if anyone has pointer 
thanks,  and thanks for suffering my dumb questions.

--
Matt

---

From: "Boyle Owen" <[email-masked]>
Date: Wed, 31 Jul 2002 18:02:19 +0200

See comments,

Rgds,

Owen Boyle

>-----Original Message-----
>Sent: Mittwoch, 31. Juli 2002 17:01
>To: [email-masked]
>Subject: RE: Error message help
>
>
>Well I may have figured this out, https is now running, cert 
>was in the wrong place, 

..or your SSLCertificateFile directive was pointing to the wrong place :-)

> ...but https returns the default web page for the apache 

Check out your DocumentRoot directive in the SSL virtual host - there should only be one. If there is more than one, apache will use the last one... It is this directive which tells apache where to fetch the content.

>>> >OpenSSL: error:0D06B078:asn1 encoding 
>routines:ASN1_get_object:header 
>>> too long
>>> >
>>>

Um... If I were you, I'd get apache 1.3.26, OpenSSL 0.9.6e and mod_ssl 2.8.10. That's teh latest mix, also pay attention to the security advisory that was posted to the list today. 

>>>- Static or DSO?

When you compiled apache, did you statically compile in mod_ssl (i.e. --enable-module=ssl) so that the mod_ssl binary gets munged in with the apache binary to produce a big binary *or* did you compile mod_ssl as a shared object which would be loaded dynamically at runtime (DSO = Dynamic Shared Object), i.e. --enable-shared=ssl? Usually, it doesn't make much difference when they're working, but since yours was not working, I thought I'd ask.

>>IE, Mozilla, you name it.

Just in case it was a funny browser - SSL is as much to do with the client as it is to do with the server so it is essential to verify any problems with several browsers. But you've already done that.