Problems with a SSL conf.
Hi, I'm using a Apache webserver version 2.0.43 and mod_ssl (the latest version). I configured the ssl.conf file and i start the webserver with the command "apachectl startssl". If i enable the following configuration instruction into the ssl.conf file : "SSLVerifyClient require" i can't connect to to my server and i received a strange composite error into the error_log file: [Wed Nov 27 11:55:17 2002] [error] Spurious SSL handshake interrupt [Hint: Usual ly just one of those OpenSSL confusions!?] [Wed Nov 27 11:55:17 2002] [error] SSL Library Error: 336105671 error:140890C7:l ib(20):func(137):reason(199) What's wrong I'm not sure to pass the right certificate to the client. How have i to proceed? Someone has maybe an example using an Apache webserver and a MSIE 6.0 client? With my best regards. P-Yves __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Problems with a SSL conf.
i was have this problem at 3 days ago. i cant know what cause this problem, so, i restore a backup ... good look Alexandre Pierre-Yves Jaquenoud wrote: > Hi, > I'm using a Apache webserver version 2.0.43 and mod_ssl (the latest > version). > I configured the ssl.conf file and i start the webserver with the command > "apachectl startssl". > > If i enable the following configuration instruction into the ssl.conf file : > "SSLVerifyClient require" > i can't connect to to my server and i received a strange composite error > into the error_log file: > [Wed Nov 27 11:55:17 2002] [error] Spurious SSL handshake interrupt [Hint: > Usual > ly just one of those OpenSSL confusions!?] > [Wed Nov 27 11:55:17 2002] [error] SSL Library Error: 336105671 > error:140890C7:l > ib(20):func(137):reason(199) > > What's wrong > > I'm not sure to pass the right certificate to the client. How have i to > proceed? Someone has maybe an example using an Apache webserver and a MSIE > 6.0 client? > > With my best regards. > > P-Yves > > __ > Apache Interface to OpenSSL (mod_ssl) www.modssl.org > User Support Mailing List [EMAIL PROTECTED] > Automated List Manager[EMAIL PROTECTED] begin:vcard n:da Silva Augusto;Alexandre x-mozilla-html:FALSE org:Secretaria de Estado dos Negocios da Fazenda;DTI - Departamento de Tecnologia da Informacao adr:;; version:2.1 email;internet:[EMAIL PROTECTED] title:Administrador de Sistemas Unix x-mozilla-cpt:;3424 fn:Alexandre da Silva Augusto end:vcard
Re: Problems with a SSL conf.
SSLVerifyClient is for verify the client certificate in SSLv3 So maybe try to setup SSLProtocol SSLv3 I did that earlier and it's working fine m.e Pierre-Yves Jaquenoud wrote: Hi, I'm using a Apache webserver version 2.0.43 and mod_ssl (the latest version). I configured the ssl.conf file and i start the webserver with the command "apachectl startssl". If i enable the following configuration instruction into the ssl.conf file : "SSLVerifyClient require" i can't connect to to my server and i received a strange composite error into the error_log file: [Wed Nov 27 11:55:17 2002] [error] Spurious SSL handshake interrupt [Hint: Usual ly just one of those OpenSSL confusions!?] [Wed Nov 27 11:55:17 2002] [error] SSL Library Error: 336105671 error:140890C7:l ib(20):func(137):reason(199) What's wrong I'm not sure to pass the right certificate to the client. How have i to proceed? Someone has maybe an example using an Apache webserver and a MSIE 6.0 client? With my best regards. P-Yves __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED] __ Modem offert : 150,92 euros remboursés sur le Pack eXtense de Wanadoo ! Haut débit à partir de 30 euros/mois : http://www.ifrance.com/_reloc/w __ Modem offert : 150,92 euros remboursés sur le Pack eXtense de Wanadoo ! Haut débit à partir de 30 euros/mois : http://www.ifrance.com/_reloc/w __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
Re: Win32 Binary Builds
On Tue, 2002-11-26 at 15:15, Paul Christmann wrote: > I'm just installing my first Apache server on a W2K box, and I'd like to > include SSL support. From browsing this newsgroup and reading the > apache docs, it appears that the following statements are true (please > correct me if I'm wrong): > > 1. mod_ssl source is now bundled in Apache 2.X true > 2. No binary version of Apache 2.X is available with mod_ssl support. true (sort of ... but) I am providing binaries (preferred) http://hunter.campbus.com/Apache_1.3.27-Mod_SSL_2.8.12-OpenSSL_0.9.6g-Win32.zip http://hunter.campbus.com/Openssl-0.9.6g-Win32.zip http://hunter.campbus.com/Apache_2.0.43-OpenSSL_0.9.6g-Win32.zip or (limited bandwidth) http://tor.ath.cx/~hunter/apache/Apache_1.3.27-Mod_SSL_2.8.12-OpenSSL_0.9.6g-Win32.zip http://tor.ath.cx/~hunter/apache/Openssl-0.9.6g-Win32.zip http://tor.ath.cx/~hunter/apache/Apache_2.0.43-OpenSSL_0.9.6g-Win32.zip > 3. Compiling Apache source requires MSVC 5 false - I do not want to split hairs but it is built with MSVC 6 Also, I think Apache can be built with Cygwin and Mingw32 but I have not done either yet. I have Mingw32 compiling simple Win32 applications on my Debian Linux box and will be trying eventually to build the Apache binaries from Linux (cross-compile). Currently I use MSVC 6, MASM, Cygwin(Bison,Flex,Awk), and Perl to build Apache. Where I am employed I distribute as many as 20,000 Apaches - my Win32 binaries - they are compiled with SSL but not configured to use it. > > I've found several links (thanks primarily to "hunter" for links and > instructions) to downloading SSL executables built for Windows, and am > starting to play with them. But I am left with two questions: > > 1. Why isn't there an Apache 2.X binary distribution with SSL? As best > I can tell, there is an issue with export laws. But why doesn't that > same issue apply to non-windows builds? > There is some uncertainty I suppose about the export laws, like you say. I do not know why this does not apply to non-windows. > 2. I don't have (nor do I want to purchase) a MS license. Without > that, is there any way I can compile Apache 2.X? (I have and use > cygwin's gcc and make if that matters) > When I updated my Cygwin I think there was the opportunity to get the source and build Apache. I did not do it that way since I have all of the other tools. I think you should give both Mingw32 and Cygwin another look. > Thanks, > > Paul Christmann > hunter __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
httpd.mm.sem
I am very new to apache. What exactly is the httpd.mm.*.sem file? I have 4 of these files in my logs directory and all 4 are zero byte files. Thanks! Jennifer __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]
What is a good way to determine this
I have what I think is probably an easy question to answer, but I have done some searching and have not found anything obvious. The gist of the question is: I have mod_ssl running and have my entire site covered with it (there is nothing listening on port 80). I also have .htaccess files forcing people to log into the site. Is the username and password transaction from the .htaccess prompt encrypted, being as it is the first thing the user logging on is prompted to perform? My gut feeling is, of course. I have SSL options protecting the directory and the .htaccess file (i will include those at the end). But the reason why I am doubting myself is the logs show me something sketchy. I have a Custom log that shows the username and SSL environment variables of the user logging in: ... LogFormat "%t \t%u \t--> %{SSL_CIPHER}e %{SSL_CIPHER_USEKEYSIZE}e %{SSL_PROTOCOL}e <-- \t%r" sslformat CustomLog logs/ssl/mbsindassl.log sslformat ... But here is the log file entry that I am worried about: ... [27/Nov/2002:16:46:29 -0500] - --> - - - <-- GET /index.html HTTP/1.1 [27/Nov/2002:16:46:34 -0500] mbarton --> RC4-MD5 128 SSLv3 <-- GET /index.html HTTP/1.1 ... The log file shows first the request with no username (which makes sense because they haven't logged on yet) but the SSL environment variables are all NULL too. So is this just a problem with the way environment variables are reported to the log? Because it looks like there is not an SSL connection before the user logs in! I have verifed that SSL is up and running and working correctly for the site with s_client. The software I am using is: Windows 2000 Apache 1.3.27 Mod_SSL 2.8.12 OpenSSL 0.9.6g Here is the top-level .htaccess file AuthName "Dude, you had better be authorized" AuthType Basic AuthUserFile "C:/MBserver/Apache/bin/.htpasswd" SSLRequireSSL SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 require user mbarton Here is the relevant SSL Portion of the httpd.conf file --- AddType application/x-x509-ca-cert .crt AddType application/x-pkcs7-crl.crl SSLMutex sem SSLSessionCache dbm:logs/ssl/scache SSLSessionCacheTimeout 400 SSLRandomSeed startup builtin SSLRandomSeed connect builtin SSLLog logs/ssl/engine.log SSLLogLevel warn DocumentRoot "C:/MBserver/Apache/secure" ErrorLog logs/ssl/error.log LogLevel debug TransferLog logs/ssl/access.log LogLevel debug AccessFileName .htaccess LogFormat "%>s \t%u \t%r \t%t \t%f \t%h \t%a \t%A \t%c \t%b \t%e \t%p \t%s" docscommon LogFormat "%t \t%u \t%{Referer}i -> %U" docsreferer LogFormat "%t \t%u \t%{User-agent}i" docsagent LogFormat "%t \t%u \t%r" docssmall LogFormat "%t \t%u \t--> %{SSL_CIPHER}e %{SSL_CIPHER_USEKEYSIZE}e %{SSL_PROTOCOL}e <-- \t%r" sslformat CustomLog logs/ssl/mbsinda.log docscommon CustomLog logs/ssl/mbsindareferer.log docsreferer CustomLog logs/ssl/mbsindaagent.log docsagent CustomLog logs/ssl/mbsindasmall.log docssmall CustomLog logs/ssl/mbsindassl.log sslformat ScriptAlias /cgi-bin/ "C:/MBserver/Apache/secure/cgi-bin/" SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 SSLOptions +StdEnvVars +ExportCertData SSLProtocol -all +SSLv3 SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+SSLv3:-EXP:-LOW:-SSLv2 SSLCertificateFile "C:/MBserver/Apache/conf/ssl-AA/MBsindaSSL.crt" SSLCertificateKeyFile "C:/MBserver/Apache/conf/ssl-AA/MBsindaSSL.key" SSLCACertificateFile "C:/MBserver/Apache/conf/ssl-AA/MBsindaCA.crt" SSLCACertificatePath "C:/MBserver/Apache/conf/ssl-AA" SSLOptions +CompatEnvVars +StdEnvVars SSLEngine on I appreciate you guys taking a look at this, Thanks, Mark Barton __ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager[EMAIL PROTECTED]