Subject: freebsd SSLCryptoDevice

From: "Robert McMonigal" <[email-masked]>
Date: Mon, 08 Jul 2002 19:38:56 +0000

I have been trying to get an aep hardware acclerator to work under apache 
2.0.39.  Everything installs fine and it runs fine with SSLCryptoDevice 
builtin.  But if I change builtin to aep and try to start it, it appears to 
start mormally (no error messages from the console) but in the error log I 
get "Init: Failed to enable Crypto Device API `aep'" I know the card is 
working because I can do openssl speed rsa1024 -engine aep and the CPU time 
is less then a second for ten seconds of computations.  I have tried this on 
redhat 7.3 and it works.  So I was wondering if apache 2 compiles 
differently on freebsd then redhat.  Any ideas on what is going wrong would 
be greatly appreciated.

I run the following command for the configure

CFLAGS="-DSSL_EXPERIMENTAL -DSSL_ENGINE" ./configure 
--prefix=/usr/local/httpd --enable-ssl 
--with-ssl=/usr/local/src/openssl-engine-0.9.6d

Thanks,

Rob

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Geoff Thorpe <[email-masked]>
Date: Tue, 9 Jul 2002 12:04:03 -0400 (EDT)

> --with-ssl=/usr/local/src/openssl-engine-0.9.6d

Can you ensure you've got a decent debugging level set (eg. perhaps
"SSLLogLevel info") and post the last few lines of the error log when
starting up apache? That should include the openssl-generated error stack
which will go some way further to saying how/why the initialisation
failed. I'd suspect it's a failure to load the AEP-specific shared-library
(ie. a path issue) but without more info it's difficult to tell.

BTW: I assume you've verified that when you say "openssl speed rsa1024
-engine aep" is working, that you're talking about the copy of the
'openssl' binary in /usr/local/src/openssl-engine-0.9.6d and *not* the
'openssl' binary installed in a system $PATH as part of the freebsd
distribution? If not, you're comparing success with one (packaged,
installed, and quite possibly modified) build of openssl with failure of
an entirely different build of openssl.

Cheers,
Geoff

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 10 Jul 2002 01:48:15 -0400 (EDT)

> "SSLLogLevel info") and post the last few lines of the error log when

Note that there's no such thing as a separate SSLLog/SSLLogLevel in Apache
2.0 anymore -- it's all lumped in with the regular error_log.

--Cliff

---

From: Mads Toftum <[email-masked]>
Date: Wed, 10 Jul 2002 09:02:16 +0200

> 2.0 anymore -- it's all lumped in with the regular error_log.
<flame mode>
Which is a really bad move IMHO - debugging with mod_ssl was very good, and
easy to use, but now with 2.0 it has been hacked into something much less
usable. Making the loglevel tie in with the general loglevel, you get debugging
info from two places at once, that it _very_ rarely makes sense to debug 
together. For those of us who actually use the SSLLog as proof that every 
transaction did in fact have the right levels of crypto etc, this is a real
PITA change. But I suppose that is what happens when someone decides to apr'ize
stuff they don't really know a whole lot about.
</flame mode>

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 10 Jul 2002 12:23:22 -0400 (EDT)

On Wed, 10 Jul 2002, Mads Toftum wrote:

> <flame mode> Which is a really bad move IMHO - debugging with mod_ssl
> was very good, and easy to use, but now with 2.0 it has been hacked into
> something much less usable. Making the loglevel tie in with the general
> loglevel, you get debugging info from two places at once, that it _very_
> rarely makes sense to debug together.

FWIW, I was in the camp that totally agrees with this sentiment.  The
decision to get rid of it was by no means unanimous.  Feel free to start a
grassroots petition to get it added back in again.  :)  If the users want
it back, the users want it back...

--Cliff