Update... Scratch the bit at the end about the [warn] messages in the ssl_error_log. Looking way back into the logs, I get them all the time. So, that's not a clue anymore.
- Larry P. Larry Nelson wrote on 12/13/2013 12:09 PM:
Wondering if anyone else has seen this... I have a web server with following details: - 2.6.18-371.3.1.el5 #1 SMP Thu Dec 5 11:39:02 CST 2013 x86_64 x86_64 x86_64 GNU/Linux - Scientific Linux SL release 5.5 (Boron) - httpd-2.2.3-82.sl5.x86_64 The server has been running fine for years. I am not the author of the website, I just maintain the box (security and kernel updates). On Dec 10, yum updated to the following (among others): - nspr-4.10.2-2.el5_10.i386 - nspr-4.10.2-2.el5_10.x86_64 - nss-3.15.3-3.el5_10.i386 - nss-3.15.3-3.el5_10.x86_64 - nss-tools-3.15.3-3.el5_10.x86_64 - nspr-devel-4.10.2-2.el5_10.x86_64 - nss-devel-3.15.3-3.el5_10.x86_64 - mod_nss-1.0.8-8.el5_10.x86_64 The httpd daemon was not restarted at that point (because I missed the instructions in the errata email). Then on Dec 11, with the php security update, I *did* restart httpd. But now when httpd starts, I see in /var/log/httpd/error_log lots and lots of: [error] NSS_Initialize failed. Certificate database: /etc/httpd/alias. [error] SSL Library Error: -8038 SEC_ERROR_NOT_INITIALIZED And httpd daemons start and then fail with: [notice] child pid 9784 exit signal Segmentation fault (11) And in /var/log/httpd/ssl_error_log I see: [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [warn] RSA server certificate CommonName (CN) `localhost.localdomain' does NOT match server name!? As a temp workaround, I've moved /etc/httpd/conf.d/nss.conf to nss.conf.BAK and restarted httpd, which works, and it's up and running, but I'm assuming the nss/nspr was there to provide encryption for a login mechanism. The P.I. (principal investigator) of the site says logins still work, but, as I said, they won't be encrypted (if that was the norm before). Not knowing much about nss/nspr for a web site, I'm also guessing that the ssl_error_log message about: `localhost.localdomain' does NOT match server name!? is the clue to the problem, but why all of a sudden with the latest nss/nspr update? Perhaps more to the point, how to fix? Thanks! - Larry
-- P. Larry Nelson (217-244-9855) | Systems/Network Administrator 461 Loomis Lab | High Energy Physics Group 1110 W. Green St., Urbana, IL | Physics Dept., Univ. of Ill. MailTo:lnel...@illinois.edu | http://www.roadkill.com/lnelson/ ------------------------------------------------------------------- "Information without accountability is just noise." - P.L. Nelson