Subject: PassPhraseDialog BuiltIn not supported...

From: "Chris Hsiang" <[email-masked]>
Date: Thu, 30 May 2002 18:04:16 -0400

Recently I got a certicate from one of the CA authority. However, my
SSL.log is giving me an error.  I don't know what did I do wrong can
anyone help me?

[30/May/2002 17:31:16 05760] [info]  Init: Initializing OpenSSL
library[30/May/2002 17:31:16 05760] [info]  Init: Initializing OpenSSL
library
[30/May/2002 17:31:16 05760] [info]  Init: Seeding PRNG with 136 bytes
of entropy
[30/May/2002 17:31:17 05760] [info]  Init: (secure.*****.com:443)
Loading certificate & private key of SSL-aware server
[30/May/2002 17:31:17 05760] [error] Init: PassPhraseDialog BuiltIn not
supported in server private key from file
F:/Apache/Apache2/conf/ssl/secure.key (OpenSSL library error follows)
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D084069:asn1
encoding routines:d2i_ASN1_SET:bad tag
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D09D082:asn1
encoding routines:d2i_RSAPrivateKey:parsing
[30/May/2002 17:31:17 05760] [error] OpenSSL: error:0D09B00D:asn1
encoding routines:d2i_PrivateKey:ASN1 lib

I am using Apache/2.0.35 (Win32) mod_ssl/2.0.35 OpenSSL/0.9.6c

Chris Hsiang
Intervivos LLC

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 30 May 2002 18:17:39 -0400 (EDT)

> F:/Apache/Apache2/conf/ssl/secure.key (OpenSSL library error follows)

It means you can't use SSLPassPhraseDialog BuiltIn on Win32.  Either use
the SSLPassPhraseDialog exec:/path/to/program method or just get rid of
the passphrase.  (I recommend the latter.)

Granted, it's a rather obtuse error message.  I just changed it for
2.0.37.

Hope this helps,
--Cliff

---

From: "Chris Hsiang" <[email-masked]>
Date: Thu, 30 May 2002 18:27:28 -0400

>>the passphrase.  (I recommend the latter.)

what exec I can use on win32 to submit the passphrase and also, how do I
get rid of the passphrase from my private key now?

Chris Hsiang
Intervivos LLC

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 30 May 2002 18:35:01 -0400 (EDT)

On Thu, 30 May 2002, Chris Hsiang wrote:

> what exec I can use on win32 to submit the passphrase and also

You'd have to write your own script to do it.  But keep in mind that
protecting the _script_ with the passphrase hardcoded into it is hard, and
even if you manage to do that, there are still problems protecting the key
since the web server has the decrypted private key in-memory after you've
submitted the passphrase.

Whether passphrases are any good or not is a bit of an ongoing heated
debate on this mailing list (AND NO, GUYS, LET'S NOT GO THROUGH THAT AGAIN
PLEASE :-)... just suffice it to say that you should be aware of the
security implications of either choice when deciding how best to protect
your private key.

> how do I get rid of the passphrase from my private key now?

See http://www.modssl.org/docs/2.8/ssl_faq.html#ToC31 .  It's in
unix-speak, but it shouldn't be hard to see what to do.  It's the openssl
command that is the important one... and of course be sure to set the
permissions correctly on the key.

--Cliff

---

From: "Chris Hsiang" <[email-masked]>
Date: Thu, 30 May 2002 18:50:57 -0400

Thanks it worked.  I have removed the pass phrase and I have absolute no
intention to start another hot debate.  I am still new to MOD_SSL and
Apache 2.0.X

Chris Hsiang
Intervivos LLC