Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

Apache2 problem sa ssl-om?

[es] :: Linux/UNIX serveri i servisi :: Apache2 problem sa ssl-om?

[ Pregleda: 2173 | Odgovora: 8 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

Elza

Član broj: 14016
Poruke: 391
*.tel.net.ba.



Profil

icon Apache2 problem sa ssl-om?20.01.2009. u 13:32 - pre 185 meseci
Evo uradila sam instalaciju u RedHat Enterprise:

cd httpd-2.2.11/


./configure --enable-ssl --enable-so --with-ssl=/usr/local/ssl --prefix=/usr/local/apache2

make

make install

sad se generiraju certifikati

cd /usr/local/apache2
openssl genrsa -des3 -out ca.key 1024
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
openssl genrsa -des3 -out server.key 1024
openssl req -new -days 365 -key server.key -out server.crt

Dobila sam fajlove server.crt server.csr i server.key pod /usr/local/apache2

cd ..

cd php-4.4.8

./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql=/usr/local/mysql --prefix=/usr/local/apache2/php --with-openssl=/usr/local/ssl --with-imap=/usr/local/imap-2007e
--with-imap-ssl=/usr/local/ssl --enable-memory-limit=yes --enable-debug=no
--with-xml --enable-track-vars --with-gd --with-zlib-dir=/usr/local --with-png-dir=/usr/local --with-jpeg-dir=/usr/local/src/jpeg-6b

make

make install


cp php.ini-dist /usr/local/lib/php.ini

E sad podesila httpd.conf

Kad idem /usr/local/apache2/bin/apachectl start

podigne se sve normalno, ali nikako neće ssl da se starta..

 
Odgovor na temu

vladared
Vladimir Crveni
Sistem Administrator
Novi Sad

Moderator
Član broj: 50291
Poruke: 1026
*.otpbanka.co.yu.

Sajt: www.itpoint.rs


+394 Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 13:54 - pre 185 meseci
Pogledaj da li je uključen mod_ssl. Sledeće pogledaj da li si uključila SSL sa SSLEngine on .
Isto tako pogledaj da li su dobro navedene putanje do fajlova i da li slučajno nije uključen neki externi ssl.conf pa da ti ne vuče konfiguraciju odatle...
 
Odgovor na temu

Elza

Član broj: 14016
Poruke: 391
*.tel.net.ba.



Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 14:23 - pre 185 meseci
Uklučen je ssl_module to vidim iz

[root@ls172 bin]# ./httpd -M
Loaded Modules:
core_module (static)
authn_file_module (static)
authn_default_module (static)
authz_host_module (static)
authz_groupfile_module (static)
authz_user_module (static)
authz_default_module (static)
auth_basic_module (static)
include_module (static)
filter_module (static)
log_config_module (static)
env_module (static)
setenvif_module (static)
ssl_module (static)
mpm_prefork_module (static)
http_module (static)
mime_module (static)
status_module (static)
autoindex_module (static)
asis_module (static)
cgi_module (static)
negotiation_module (static)
dir_module (static)
actions_module (static)
userdir_module (static)
alias_module (static)
so_module (static)
php4_module (shared)
Syntax OK

I dobre su putanje za key-ve u /usr/local/apache2/conf/extra/httpd-ssl.conf
SSlEngine On

Ali kad idem /usr/local/apachectl start

on upita passphrasu ali se ne digne nikako
 
Odgovor na temu

Jbyn4e

Član broj: 422
Poruke: 6049
*.yunix.co.rs.



+257 Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 15:03 - pre 185 meseci
A ti znas da se ssl ne "starta" kako?

Kad sve ostalo zakaže, pročitaj uputstvo...
 
Odgovor na temu

Tyler Durden
Tyler Durden
Beograd

Član broj: 4312
Poruke: 3379
*.verat.net.



+1365 Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 15:11 - pre 185 meseci
I šta stoji u logovima...?
Beneath civilization's fragile crust, cold chaos churns...
 
Odgovor na temu

Elza

Član broj: 14016
Poruke: 391
*.tel.net.ba.



Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 15:17 - pre 185 meseci
Kad uradim /usr/local/apache2/bin/apachectl start

more /usr/local/apache2/bin/apachectl

#!/bin/sh
#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#
# Apache control script designed to allow an easy command line interface
# to controlling Apache. Written by Marc Slemko, 1997/08/23
#
# The exit codes returned are:
# XXX this doc is no longer correct now that the interesting
# XXX functions are handled by httpd
# 0 - operation completed successfully
# 1 -
# 2 - usage error
# 3 - httpd could not be started
# 4 - httpd could not be stopped
# 5 - httpd could not be started during a restart
# 6 - httpd could not be restarted during a restart
# 7 - httpd could not be restarted during a graceful restart
# 8 - configuration syntax error
#
# When multiple arguments are given, only the error from the _last_
# one is reported. Run "apachectl help" for usage info
#
ARGV="$@"
#
# |||||||||||||||||||| START CONFIGURATION SECTION ||||||||||||||||||||
# -------------------- --------------------
#
# the path to your httpd binary, including options if necessary
HTTPD='/usr/local/apache2/bin/httpd'
#
# pick up any necessary environment variables
if test -f /usr/local/apache2/bin/envvars; then
. /usr/local/apache2/bin/envvars
fi
#
# a command that outputs a formatted text version of the HTML at the
# url given on the command line. Designed for lynx, however other
# programs may work.
LYNX="links -dump"
#
# the URL to your server's mod_status status page. If you do not
# have one, then status and fullstatus will not work.
STATUSURL="http://localhost:80/server-status"
#
# Set this variable to a command that increases the maximum
# number of file descriptors allowed per child process. This is
# critical for configurations that use many file descriptors,
# such as mass vhosting, or a multithreaded server.
ULIMIT_MAX_FILES="ulimit -S -n `ulimit -H -n`"
# -------------------- --------------------
# |||||||||||||||||||| END CONFIGURATION SECTION ||||||||||||||||||||

# Set the maximum number of file descriptors allowed per child process.
if [ "x$ULIMIT_MAX_FILES" != "x" ] ; then
$ULIMIT_MAX_FILES
fi

ERROR=0
if [ "x$ARGV" = "x" ] ; then
ARGV="-h"
fi

case $ARGV in
start|stop|restart|graceful|graceful-stop)
$HTTPD -k $ARGV
ERROR=$?
;;
startssl|sslstart|start-SSL)
echo The startssl option is no longer supported.
echo Please edit httpd.conf to include the SSL configuration settings
echo and then use "apachectl start".
ERROR=2
;;
configtest)
$HTTPD -t
ERROR=$?
;;
status)
$LYNX $STATUSURL | awk ' /process$/ { print; exit } { print } '
;;
fullstatus)
$LYNX $STATUSURL
;;
*)
$HTTPD $ARGV
ERROR=$?
esac

exit $ERROR

Kaže da je dovoljno pokrenuti apachectl start ukoliko je ssl uključen u httpd.conf

A evo kad sam nanovo izgenerirala ključeve javlja mi

[Tue Jan 20 15:46:24 2009] [debug] ssl_engine_init.c(711): Configuring RSA server certificate
[Tue Jan 20 15:46:24 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 20 15:46:24 2009] [debug] ssl_engine_init.c(750): Configuring RSA server private key
[Tue Jan 20 15:46:24 2009] [error] Unable to configure RSA server private key
[Tue Jan 20 15:46:24 2009] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_k
ey:key values mismatch
[Tue Jan 20 16:06:32 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 20 16:06:32 2009] [error] Unable to configure RSA server private key
[Tue Jan 20 16:06:32 2009] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_k
ey:key values mismatch
[Tue Jan 20 16:07:38 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 20 16:07:38 2009] [error] Unable to configure RSA server private key
[Tue Jan 20 16:07:38 2009] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_k
ey:key values mismatch

E sad a key-eve sam izgenerirala sa ove stranice http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#keyscerts
Mislim ipak da mi key-evi nisu ok

 
Odgovor na temu

Elza

Član broj: 14016
Poruke: 391
*.tel.net.ba.



Profil

icon Re: Apache2 problem sa ssl-om?20.01.2009. u 16:24 - pre 185 meseci
Ovako konačno je da sam nanovo instalirala certifikate i podigal apache sa

/usr/local/apache2/bin/apachectl start pri tome sam uključila u httpd.conf da se pozove fajl sa ssl direktivama i podigao se apache

netstat -al
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:nrpe *:* LISTEN
tcp 0 0 *:mysql *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:https *:* LISTEN

Ipak kao da je dignut apache sa ssl-om
I u procesima vidim

/usr/local/apache2/bin/httpd -k start
www 26859 0.0 0.0 29532 5876 ? S 17:17 0:00 /usr/local/apache2/bin/httpd -k start
www 26860 0.0 0.0 29532 5840 ? S 17:17 0:00 /usr/local/apache2/bin/httpd -k start

Kad pozovem starnicu http://nešto radi ali ako idem sa https://nešto ne radi.

E sad u errorima imam:

[notice] caught SIGTERM, shutting down
[Tue Jan 20 17:17:53 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 20 17:17:53 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jan 20 17:17:53 2009] [notice] Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8f PHP/4.4.8 configured -- resuming normal operation
 
Odgovor na temu

Elza

Član broj: 14016
Poruke: 391
*.tel.net.ba.



Profil

icon Re: Apache2 problem sa ssl-om?21.01.2009. u 11:16 - pre 185 meseci
Sve riješeno! Radi..

Falila je direktiva za Name VirtualHost u httpd.conf
tj.

NameVirtualHost ipadresa:80
NameVirtualHost ipadresa:443

i onda se ti Virtal Hostovi pozovu dalje

<VirtualHost ipadresa:80>
ServerAdmin [email protected]
DocumentRoot /var/www/nesto/public_html
ScriptAlias /cgi-bin/ "/var/www/nesto/cgi-bin/"
ServerName nesto
ErrorLog logs/ls172.tel.net.ba-error_log
CustomLog logs/ls172.tel.net.ba-access_log combined
</VirtualHost>

<VirtualHost ipadresa:443>
ServerAdmin [email protected]
DocumentRoot /var/www/nesto/public_html
ScriptAlias /cgi-bin/ "/var/www/nesto/cgi-bin/"
ServerName nesto
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/server.key
ErrorLog logs/nesto-error_log
CustomLog logs/nesto-access_log combined
</VirtualHost>
 
Odgovor na temu

[es] :: Linux/UNIX serveri i servisi :: Apache2 problem sa ssl-om?

[ Pregleda: 2173 | Odgovora: 8 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.