Subject: RE: SSL w/ Virtual Hosts startup failure...

From: "Bill Adams" <[email-masked]>
Date: Thu, 18 Jul 2002 17:38:29 -0400

You could try adding these directives inside your virtual host block (or else make the scope global if you wish):

  SSLLog /var/log/httpd/{virtual-host-name}-ssl_log
  SSLogLevel debug

These will provide some verbose debug spew in the ssl log file that might help.

-----Original Message-----
From: Sean M Alderman [mailto:[email-masked]]
Sent: Thursday, July 18, 2002 5:21 PM
To: [email-masked]
Subject: SSL w/ Virtual Hosts startup failure...

Hi, I just received certs today for a couple of Vhosts.  I setup their
SSL vhosts like -

<IfDefine SSL>

<VirtualHost 111.222.444.333:443>

# Server Info
ServerName www.server.com
ServerAdmin [email-masked]

# SSL Stuff
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/appl/www/www.server.com/certs/server.crt
SSLCertificateKeyFile /usr/appl/www/www.server.com/certs/server.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/appl/www/www.server.com/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog /usr/appl/www/cws.grc.nasa.gov/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

# Document Directory Information
DocumentRoot /usr/appl/www/www.server.com/htdocs
<Directory />
  Options +Includes
</Directory>

# Jakarta Mounts for the
# Bobby Section 508 software
JkMount /bobby ajp13
JkMount /bobby/*.jsp ajp13

# CGI Directories
ScriptAlias /cgi-bin/ "/usr/appl/www/www.server.com/cgi-bin/"

# Log Configuration
ErrorLog /usr/appl/www/www.server.com/logs/error_log
CustomLog "|/usr/appl/apache/bin/rotatelogs
/usr/appl/www/www.server.com/logs/access_log 2419200" combined

</VirtualHost>

</IfDefine>

I configured ssl and certs for 3 vhosts and tested each one after I made
the configuration for it.  The server started after the first ssl
config, and the second, but it's not starting on the last.  The SSL
Engine Log is here, access_log and error_log have are empty

==> ssl_engine_log <==
[18/Jul/2002 17:09:30 11938] [info]  Server: Apache/1.3.26, Interface:
mod_ssl/2.8.9, Library: OpenSSL/0.9.6d
[18/Jul/2002 17:09:30 11938] [info]  Init: 1st startup round (still not
detached)
[18/Jul/2002 17:09:30 11938] [info]  Init: Initializing OpenSSL
library[18/Jul/2002 17:09:30 11938] [info]  Init: Loading certificate &
private key of SSL-aware server mailarch.grc.nasa.gov:443
[18/Jul/2002 17:09:30 11938] [info]  Init: Loading certificate & private
key of SSL-aware server cws.grc.nasa.gov:443
[18/Jul/2002 17:09:30 11938] [info]  Init: Loading certificate & private
key of SSL-aware server webapp.grc.nasa.gov:443
[18/Jul/2002 17:09:30 11938] [info]  Init: Seeding PRNG with 136 bytes
of entropy
[18/Jul/2002 17:09:30 11938] [info]  Init: Generating temporary RSA
private keys (512/1024 bits)
[18/Jul/2002 17:09:31 11938] [info]  Init: Configuring temporary DH
parameters (512/1024 bits)

Is there some advanced logging I can do to determine the problem?  Has
this been handled before (and I didn't use the right search terms)?

Thanks!

-- 
Sean M. Alderman
ITRACK Systems Analyst
PACE/NCI - NASA Glenn Research Center
(216) 433-2795

Calling a windowed operating system "Windows" is like naming an
automobile "Wheels."
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Sean M Alderman <[email-masked]>
Date: 19 Jul 2002 09:26:08 -0400

Well, I added the lines you suggested to the vhost config for the one
that keeps apache from starting.  The vhost-ssl_log file looks like -

# more ssl_log
[19/Jul/2002 09:18:38 13253] [info]  Init: Loading certificate & private
key of SSL-aware server xxx.grc.nasa.gov:443
[19/Jul/2002 09:18:38 13253] [trace] Init: (xxx.grc.nasa.gov:443)
unencrypted RSA private key - pass phrase not required

Doesn't seem to be anything useful there.  And if I comment out this
virtual host (config below) Apache seems to work just fine.  All the
other vhosts startup (http and https).  When I created the configs for
these vhosts, I just copied the directives for each ssl vhost I needed
and changed the paths/certs/hostnames/etc...

Here's the vhost config again -
<IfDefine SSL>

<VirtualHost 192.55.91.186:443>

# Server Info
ServerAdmin [email-masked]
ServerName xxx.grc.nasa.gov

# SSL Stuff
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/appl/www/xxx.grc.nasa.gov/certs/xxx.crt
SSLCertificateKeyFile /usr/appl/www/xxx.grc.nasa.gov/certs/xxx.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/usr/appl/www/xxx.grc.nasa.gov/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
CustomLog /usr/appl/www/xxx/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
SSLLog /usr/appl/www/xxx.grc.nasa.gov/logs/ssl_log
SSLLogLevel debug

# Document Directories
DocumentRoot /usr/appl/www/xxx.grc.nasa.gov/htdocs
<Directory />
  Options +Includes
</Directory>

# Log Configuration
ErrorLog /usr/appl/www/xxx.grc.nasa.gov/logs/error_log
CustomLog "|/usr/appl/apache/bin/rotatelogs
/usr/appl/www/xxx.grc.nasa.gov/logs/access_log 2419200" combined

</VirtualHost>

</IfDefine>

On Thu, 2002-07-18 at 17:38, Bill Adams wrote:
> private key of SSL-aware server xxx.grc.nasa.gov:443

---

From: Sean M Alderman <[email-masked]>
Date: 19 Jul 2002 09:33:26 -0400

Duh.  I just found a bad path for a log file in the config I put in here
as I read my post.  Fixing that seems to have resolved the issue.  Sorry
for the trouble.

On a side note though, is it considered to be a "best practice" to store
vhost config info in the httpd.conf?  I had thought I might create
config files for each vhost and include them into the main config file,
to make things easier to manage.  Just curious.