Re: [users@httpd] Connection TLS Error
On Sun, 2023-11-19 at 16:16 -0500, Frank Gingras wrote: > > > On Sun, Nov 19, 2023 at 3:25 PM John wrote: > > On Sun, 2023-11-19 at 15:17 -0500, Eric Covener wrote: > > > On Sun, Nov 19, 2023 at 3:15 PM John wrote: > > > > > > > > On Sun, 2023-11-19 at 14:35 -0500, Eric Covener wrote: > > > > > On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > > > > > > > > > > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a > > > > > > browser error: > > > > > > Error code: SSL_ERROR_RX_RECORD_TOO_LONG (Firefox) > > > > > > > > > > What does your SSL-enabled virtualhost look like > > > > > > > > Here is the example.conf include file; ssl.conf follows > > > > > > > > # SSL Support for example.ca ONLY! > > > > > > > > ServerName www.example.ca > > > > ServerAlias t.example.ca > > > > DocumentRoot /usr/httpd/example > > > > Options -MultiViews > > > > H2Direct on > > > > ProxyPassMatch "^/.*\.php(/.*)?$" > > > > fcgi://127.0.0.1:9002/usr/httpd/example > > > > # SSLEngine on > > > > > > ^^^ Pretty suspicious? > > > > > > > > > SSLEngine being commented out? It is already turned on in ssl.conf and one > > of the problems that > > I > > already had to fix was duplicate entries between conf file sections. > > > - > > > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > > > For additional commands, e-mail: users-h...@httpd.apache.org > > > > > > > > > > > > > - > > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > > For additional commands, e-mail: users-h...@httpd.apache.org > > > > > > > You can't inherit SSLEngine on like that - you must either set it in the > vhost context, or include > a file that sets it. I don't see an include directive in your vhost, either. Thanks Frank and Eric. I kind of suspected that when I thought about it but truly Eric caught me by surprise because I had to delete (comment out actually) a number of things that can't appear in multiple places. (eg Listen). Thanks again fellows. John == - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org
Re: [users@httpd] Connection TLS Error
On Sun, Nov 19, 2023 at 3:25 PM John wrote: > On Sun, 2023-11-19 at 15:17 -0500, Eric Covener wrote: > > On Sun, Nov 19, 2023 at 3:15 PM John wrote: > > > > > > On Sun, 2023-11-19 at 14:35 -0500, Eric Covener wrote: > > > > On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > > > > > > > > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a > browser error: > > > > > Error code: SSL_ERROR_RX_RECORD_TOO_LONG(Firefox) > > > > > > > > What does your SSL-enabled virtualhost look like > > > > > > Here is the example.conf include file; ssl.conf follows > > > > > > # SSL Support for example.ca ONLY! > > > > > >ServerName www.example.ca > > > ServerAlias t.example.ca > > >DocumentRoot /usr/httpd/example > > >Options -MultiViews > > >H2Direct on > > >ProxyPassMatch "^/.*\.php(/.*)?$" fcgi:// > 127.0.0.1:9002/usr/httpd/example > > > # SSLEngine on > > > > ^^^ Pretty suspicious? > > > > > SSLEngine being commented out? It is already turned on in ssl.conf and > one of the problems that I > already had to fix was duplicate entries between conf file sections. > > - > > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > > For additional commands, e-mail: users-h...@httpd.apache.org > > > > > > - > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > For additional commands, e-mail: users-h...@httpd.apache.org > > You can't inherit SSLEngine on like that - you must either set it in the vhost context, or include a file that sets it. I don't see an include directive in your vhost, either.
Re: [users@httpd] Connection TLS Error
On Sun, 2023-11-19 at 15:17 -0500, Eric Covener wrote: > On Sun, Nov 19, 2023 at 3:15 PM John wrote: > > > > On Sun, 2023-11-19 at 14:35 -0500, Eric Covener wrote: > > > On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > > > > > > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a browser > > > > error: > > > > Error code: SSL_ERROR_RX_RECORD_TOO_LONG (Firefox) > > > > > > What does your SSL-enabled virtualhost look like > > > > Here is the example.conf include file; ssl.conf follows > > > > # SSL Support for example.ca ONLY! > > > > ServerName www.example.ca > > ServerAlias t.example.ca > > DocumentRoot /usr/httpd/example > > Options -MultiViews > > H2Direct on > > ProxyPassMatch "^/.*\.php(/.*)?$" fcgi://127.0.0.1:9002/usr/httpd/example > > # SSLEngine on > > ^^^ Pretty suspicious? > SSLEngine being commented out? It is already turned on in ssl.conf and one of the problems that I already had to fix was duplicate entries between conf file sections. > - > To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org > For additional commands, e-mail: users-h...@httpd.apache.org > - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org
Re: [users@httpd] Connection TLS Error
On Sun, Nov 19, 2023 at 3:15 PM John wrote: > > On Sun, 2023-11-19 at 14:35 -0500, Eric Covener wrote: > > On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > > > > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a browser > > > error: > > > Error code: SSL_ERROR_RX_RECORD_TOO_LONG(Firefox) > > > > What does your SSL-enabled virtualhost look like > > Here is the example.conf include file; ssl.conf follows > > # SSL Support for example.ca ONLY! > >ServerName www.example.ca > ServerAlias t.example.ca >DocumentRoot /usr/httpd/example >Options -MultiViews >H2Direct on >ProxyPassMatch "^/.*\.php(/.*)?$" fcgi://127.0.0.1:9002/usr/httpd/example > # SSLEngine on ^^^ Pretty suspicious? - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org
Re: [users@httpd] Connection TLS Error
On Sun, 2023-11-19 at 14:35 -0500, Eric Covener wrote: > On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a browser > > error: > > Error code: SSL_ERROR_RX_RECORD_TOO_LONG (Firefox) > > What does your SSL-enabled virtualhost look like Here is the example.conf include file; ssl.conf follows # SSL Support for example.ca ONLY! ServerName www.example.ca ServerAlias t.example.ca DocumentRoot /usr/httpd/example Options -MultiViews H2Direct on ProxyPassMatch "^/.*\.php(/.*)?$" fcgi://127.0.0.1:9002/usr/httpd/example # SSLEngine on # SSLCipherSuite HIGH: !ADH: !SSLv2: !SSLv3: !TLSv1: !RC4: !PSK: !MD5 SSLCipherSuite TLSv1.3 Header always set Strict-Transport-Security "max-age-63072000;includeSubDomains" # Redirect if logon is to example.ca without the 'www' ServerName www.example.ca Redirect permanent / https:example.ca ---The following, except for the certificate locations, is pretty much the config from Rocky ssl.conf # When we also provide SSL we have to listen to the # standard HTTPS port in addition. # Listen 443 https ## ## SSL Global Context ## ## All SSL configuration in this context applies both to ## the main server and all SSL-enabled virtual hosts. ## # Pass Phrase Dialog: # Configure the pass phrase gathering process. # The filtering dialog program (`builtin' is a internal # terminal dialog) has to provide the pass phrase on stdout. SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog # Inter-Process Session Cache: # Configure the SSL Session Cache: First the mechanism # to use and second the expiring timeout (in seconds). SSLSessionCache shmcb:/run/httpd/sslcache(512000) SSLSessionCacheTimeout 300 # # Use "SSLCryptoDevice" to enable any supported hardware # accelerators. Use "openssl engine -v" to list supported # engine names. NOTE: If you enable an accelerator and the # server does not start, consult the error logs and ensure # your accelerator is functioning properly. # SSLCryptoDevice builtin #SSLCryptoDevice ubsec ## ## SSL Virtual Host Context ## # General setup for the virtual host, inherited from global configuration #DocumentRoot "/var/www/html" #ServerName www.example.com:443 # Use separate log files for the SSL virtual host; note that LogLevel # is not inherited from httpd.conf. ErrorLog logs/ssl_error_log TransferLog logs/ssl_access_log LogLevel warn # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on # List the protocol versions which clients are allowed to connect with. # The OpenSSL system profile is used by default. See # update-crypto-policies(8) for more details. #SSLProtocol all -SSLv3 #SSLProxyProtocol all -SSLv3 # User agents such as web browsers are not configured for the user's # own preference of either security or performance, therefore this # must be the prerogative of the web server administrator who manages # cpu load versus confidentiality, so enforce the server's cipher order. SSLHonorCipherOrder on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. # The OpenSSL system profile is configured by default. See # update-crypto-policies(8) for more details. SSLCipherSuite PROFILE=SYSTEM SSLProxyCipherSuite PROFILE=SYSTEM # Point SSLCertificateFile at a PEM encoded certificate. If # the certificate is encrypted, then you will be prompted for a # pass phrase. Note that restarting httpd will prompt again. Keep # in mind that if you have both an RSA and a DSA certificate you # can configure both in parallel (to also allow the use of DSA # ciphers, etc.) # Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt) # require an ECC certificate which can also be configured in # parallel. # SSLCertificateFile /etc/pki/tls/certs/localhost.crt <---original SSLCertificateFile /etc/httpd/conf/sslcert/www.example.ca.pem # Server Private Key: # If the key is not combined with the certificate, use this # directive to point at the key file. Keep in mind that if # you've both a RSA and a DSA private key you can configure # both in parallel (to also allow the use of DSA ciphers, etc.) # ECC keys, when in use, can also be configured in parallel # SSLCertificateKeyFile /etc/pki/tls/private/localhost.key <---original SSLCertificateKeyFile /etc/httpd/conf/sslcert/www.example.ca.key # Server Certificate Chain: # Point SSLCertificateChainFile at a file containing the # concatenation of PEM encoded CA certificates which form the # certificate chain for the server certificate. Alternatively # the referenced file can be the same as SSLCertificateFile # when the CA certificates are directly appended to the server # certificate for convenience. #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt # Certificate Authority (CA): #
Re: [users@httpd] Connection TLS Error
On Sun, Nov 19, 2023 at 2:31 PM John wrote: > > When I try to connect to Apache (2.4.53) using TLS 1.3 I get a browser error: > Error code: SSL_ERROR_RX_RECORD_TOO_LONG(Firefox) What does your SSL-enabled virtualhost look like? - To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org
