Subject: potential apachectl modification

From: "Aryeh Katz" <[email-masked]>
Date: Mon, 22 Apr 2002 12:23:35 -0400

Does it make sense to have a restartssl directive, to match the restart 
directive?

---
Aryeh Katz
VASCO 			
www.vasco.com		

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Glen Mehn <[email-masked]>
Date: Mon, 22 Apr 2002 09:34:28 -0700

'restart' and 'graceful' will restart the server with -DSSL, if it's (currently)running with -DSSL.

'restart' sends a SIGHUP to apache
'graceful' sends a SIGUSR1 to apache, which httpd reads as 'finish what you're doing, then HUP yourself'.

glen

-- 
Glen S Mehn
Contract Systems Administrator		SquareTrade, Inc
[email-masked]	Building Trust in Transactions (sm)
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Frank Reichenbacher" <[email-masked]>
Date: Mon, 22 Apr 2002 09:42:49 -0700

Use apachectl graceful.

Frank

---

From: "Aryeh Katz" <[email-masked]>
Date: Mon, 22 Apr 2002 13:09:13 -0400

> Use apachectl graceful.
I suppose I should have done a little more research before posting.
I had a script that did a restart, and the restart reported an error. I then tried a 
start and everything worked fine, so I assumed that restart did a kill then a 
start, and thus needed to be changed for ssl.
Once I got these mails, I looked a little closer, and I'm seeing some strange 
behavior.
apachectl configtest complains on SSLEngine off in my :80 virtual host.
Fine, doesn't bother me, I comment it out (wondering why only httpd -t 
complains, and not a regular startup).
I then ran apachectl configtest again, and it reported no errors.
I ran httpd -t from the command line, and it said
Syntax OK
Segmentation Fault.
Call stack on the Segmentation Fault indicates that it's on the 
unload_module.
I do have a module of my own that is loaded, which when removed, allows 
httpd -t to run fine.
Does anyone have any suggestions for what my module might be doing to 
cause the configtest to core on unload?
Thanks.
Aryeh

> > Does it make sense to have a restartssl directive, to match the
> > restart directive?
> > 
> > ---
> > Aryeh Katz
> > VASCO 
> > www.vasco.com 
> > 
> > ____________________________________________________________________
> > __ Apache Interface to OpenSSL (mod_ssl)                  
> > www.modssl.org User Support Mailing List                     
> > [email-masked] Automated List Manager                      
> >      [email-masked]
> > 
> 

---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Peter Viertel" <[email-masked]>
Date: Mon, 22 Apr 2002 18:20:37 +0100

soft restarts like this crash httpd if you have added/deleted SSL key or
certificate lines to the config file - in these cases you must fully
stop/restart the daemon.

So I would say there is a case for a restartssl option, although I'm
happy enough to run stop, check for all daemons dying, then running
startssl as changing certs/keys is usually an infrequent task.

---

From: "Peter Viertel" <[email-masked]>
Date: Mon, 22 Apr 2002 18:25:31 +0100

httpd -t will error on SSL stuff not between <ifDefine SSL> lines. I
think you'll find that your LoadModule is in an ifDefine while the
unloadmodule isnt.

httpd -DSSL -t is the way to check all the syntax in httpd.conf, without
the -DSSL you're only checking half of it.

---

From: "Aryeh Katz" <[email-masked]>
Date: Mon, 22 Apr 2002 13:34:11 -0400

> think you'll find that your LoadModule is in an ifDefine while the
You are correct.
Putting all my stuff (which was compiled with EAPI) in the IfDefine solved the 
problem.

> httpd -DSSL -t is the way to check all the syntax in httpd.conf,
> without the -DSSL you're only checking half of it.
So this seems to be saying that it makes sense to have a restartssl, right?

---
Aryeh Katz
VASCO 			
www.vasco.com

---

From: "Frank Reichenbacher" <[email-masked]>
Date: Mon, 22 Apr 2002 10:49:02 -0700

Sheesh! I must be lucky, I have not experienced any of these problems and
the past several weeks I've been using apachectl graceful every few minutes
while I set up my SSL server.

Always the safest bet is to do a full stop/start, however, users online may
experience frustrating behaviors and then you have to commit that damn
passkey to memory. If you can get away with it restart -DSSL or graceful
will suffice for most purposes.

Frank