Subject: Possibility of no keying phrase keys?

From: "David F. Reed" <[email-masked]>
Date: Fri, 26 Jul 2002 22:57:30 -0500

Dear SSL experts and aficionados and RH gurus,

I am hoping someone out there has a piece of arcane (to me)
knowledge...

(Running RH-7.3,  apache-1.3.23-14, openssl-0.9.6b-18)

I note that during reboot (a rare event), some one trusted
has to be around to manually key in the pass phrase to the
server.key file - sometimes it waits for this, and sometimes not;
in either case, unattended, the httpd sits around waiting to start.

(I learned this the other day when a power outage convinced
my system to shut down, and it restarted when power resumed).

So my question is, is there a way to generate a key that does not
look for a pass phrase, or automagically pipe the contents of some
file, or some such work around, so that unattended, it can
come up and function as a server?

Any discussion of experience would be helpful

Many thanks.

--Dave

David F. Reed  -> email: [email-masked]
(for pgp key: [email-masked] http://keys.pgp.com/ )

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Jack L. Stone" <[email-masked]>
Date: Sat, 27 Jul 2002 07:34:27 -0500

>Any discussion of experience would be helpful

Not sure what OS you have, but I run FBSD and this is the method I use to
solve that:
To decrypt the Key:

First make a copy of the encrypted key

# cp server.key server.key.cryp
 
Then re-write the key with encryption. You will be prompted for the
original encrypted Key passphrase

# /usr/bin/openssl rsa -in server.key.cryp -out server.key
read RSA key
Enter PEM pass phrase:
writing RSA key
 
One way to secure the decrypted Private Key is to make readable only by the
root: 
# chmod 400 server.key

Best regards,
Jack L. Stone,
Administrator

Sage American
http://www.sage-american.com
[email-masked]

---

From: "Jack L. Stone" <[email-masked]>
Date: Sat, 27 Jul 2002 07:45:10 -0500

>Any discussion of experience would be helpful
....oops! It's still early here and no coffee. I see now that you run
Linux, so the paths will be different...., but perhaps the commands will
work. Not familiar with Linux....

Best regards,
Jack L. Stone,
Administrator

Sage American

---

From: Geoff Thorpe <[email-masked]>
Date: Sat, 27 Jul 2002 10:39:38 -0400 (EDT)

Hi,

On Fri, 26 Jul 2002, David F. Reed wrote:

[snip]

> in either case, unattended, the httpd sits around waiting to start.

http://www.openssl.org/support/faq.html#USER9

Cheers,
Geoff

-- 
Geoff Thorpe
[email-masked]

---

From: "David F. Reed" <[email-masked]>
Date: Sat, 27 Jul 2002 08:35:16 -0500

Many thanks Jack!

worked like a charm.

--Dave