Apache doesn't listen to 443 (https)

yapp · 07-03-2003, 10:21 AM

Hi there,

I'm trying to run a https website (for personal usage, that's why I want it to me https) Apache is working for normal http traffic, but I haven't got the https server working. I did change a little in /etc/apache/mod_ssl.conf, but nothing special. At the end of /etc/apache/httpd.conf, I uncommented the Include ...mod_ssl.conf line.

I've read a lot about the certificates, but I don't understand much of it. Apache is pre-configured at my system, (slackware 9) What do I need to do to get SSL running?

cyberskye · 07-03-2003, 12:26 PM

what are you using to start the server? Which command exactly? have you tried /path/to/apache/apachectl startssl ?

Be specific about any errors you receive.

yapp · 07-03-2003, 05:21 PM

startssl gave me this

Code:

root@hal9000 diederik # /usr/sbin/apachectl startssl
[Fri Jul  4 00:18:49 2003] [warn] module mod_ssl.c is already added, skipping
/usr/sbin/apachectl startssl: httpd could not be started

/var/log/apache/ssl_engine_log:

Code:

[04/Jul/2003 00:18:49 19716] [info]  Server: Apache/1.3.27, Interface: mod_ssl/2.8.12, Library: OpenSSL/0.9.7a
[04/Jul/2003 00:18:49 19716] [info]  Init: 1st startup round (still not detached)
[04/Jul/2003 00:18:49 19716] [info]  Init: Initializing OpenSSL library
[04/Jul/2003 00:18:49 19716] [info]  Init: Loading certificate & private key of SSL-aware server *****:443
[04/Jul/2003 00:18:49 19716] [error] Init: Unable to read server certificate from file /etc/apache/ssl.crt/server.crt (OpenSSL library error follows)
[04/Jul/2003 00:18:49 19716] [error] OpenSSL: error:0D06B08E:asn1 encoding routines:ASN1_d2i_bio:not enough data

I've been playing with SSL certificates, but I'm confused by it. (ie. what needs to be done, and what all these openssl command actually do) This definitely shows that I don't got that right.

cyberskye · 07-03-2003, 05:52 PM

Seems like a cert problem - I'd say your pkey is too short, but errors are rarely that obvious

Here is good info on how to roll your own cert. Probably be less time consuming than trying to figure out how yours was built. Skip down to the section on creating csr

http://slacksite.com/apache/certificate.html

yapp · 07-03-2003, 06:11 PM

Whoo hoo.. it's working. My apache runs https. That site has been really helpfull to understand the process too.

If I may ask just one other thing: Right now I don't have a CA-signed certificate, but is that free?

cyberskye · 07-03-2003, 06:23 PM

Quote:

If I may ask just one other thing: Right now I don't have a CA-signed certificate, but is that free?

Nope - thawte was cheaper than verisign last I checked. All CA's charge, it's their primary source of income and they are for-profit outfits. If it's just you for you and you set things up safely (tripwire, etc) you should be alright self-signed. Up to you, tho