Apache 2.2 won't default to SSL

Ixalmida · 05-11-2010, 04:59 PM

I've just built a server to mirror my current (production) web server. But for some reason, when Apache starts during boot, it won't automatically start in SSL mode. However, if I shut apache down and start it with the 'startssl' option, SSL works fine. I don't think it is a problem with the config files since I copied the entire /etc/apache2 directory over from the production server.

Before restarting Apache with the 'startssl' option, if I try to browse to the page, Firefox says:

Code:

SSL received a record that exceeded the maximum permissible length.

(Error code: ssl_error_rx_record_too_long)

Searching Google for this error produces unrelated solutions. I also get this error in the error_log:

Code:

Invalid method in request \x16\x03\x01\x97\x01

...which leads me to believe that SSL isn't even running, but if I netstat port 443, I get:

Code:

tcp     0     0 :::443     :::*     LISTEN

I've also made sure that the modules (a2enmod -l) is the same on this server as on the production server. I'm currently at a loss for ideas.

Here's the relevant parts of my vhosts file:

Code:

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost *:443>
    DocumentRoot /srv/www/htdocs
    ServerName sub.domainname.com
    SSLCertificateFile /etc/apache2/ssl.crt/server.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/server.key
    SSLEngine on
</VirtualHost>
</IfDefine>
</IfDefine>

Any clues???

bathory · 05-11-2010, 05:30 PM

2 things:

apache2 does not support "apachectl startssl". If SSL is configured correctly, running "apachectl start" will start both http and https.

You have to create a new pair of certificate/key for the new server and don't just copy the ones from the other server. Most likely, that's why you get:

Quote:

Invalid method in request \x16\x03\x01\x97\x01

Ixalmida · 05-12-2010, 10:01 AM

Thanks for the input. Unfortunately it does not resolve the problem.

First, "apachectl" isn't installed on the server. To force SSL, I use...

Code:

/etc/init.d/apache2 startssl

Second, I copied the config files from the production server after getting frustrated with this issue in my "scratch" build. I'd already tried three different tutorials for creating a self-signed test certificate (including the one in the Apache docs), but the issue persisted. Copying over the config files was a last resort.

Any other ideas?

bathory · 05-12-2010, 11:46 AM

Quote:

To force SSL, I use...
Code:

/etc/init.d/apache2 startssl

From the above, I guess you're running debian or derivatives. In that case you can use the utilities of your distro according to this post to create key/certificate.

Or you can use openssl. The steps to follow are:

Code:

GENERATE KEY
openssl genrsa -des3 -out server.key 1024

CREATE CSR
openssl req -new -key server.key -out server.csr

REMOVE PASSPHRASE
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key

CREATE CERTIFICATE
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Ixalmida · 05-12-2010, 02:35 PM

I copied/pasted what you suggested and updated my vhosts file to match the new key/cert path, started Apache and got the same error (below).

Code:

SSL received a record that exceeded the maximum permissible length.

(Error code: ssl_error_rx_record_too_long)
    *   The page you are trying to view can not be shown because the
authenticity of the received data could not be verified.
    *   Please contact the web site owners to inform them of this
problem. Alternatively, use the command found in the help menu to
report this broken site.

From Apache error_log:

Code:

Invalid method in request \x16\x03\x01\x01k\x01

And still, when I stop Apache and start with SSL:

Code:

/etc/init.d/apache2 startssl

...the site comes up just fine (albeit with some cert errors). If I subsequently restart Apache without the "startssl" option, I get the SSL error above.

Is there a way to just script the server to start up Apache with the "startssl" option on reboot? I'm familiar with "chkconfig" but not how to write a startup script. I am not as concerned about fixing this problem as I am about Apache starting the right way when the server reboots.

bathory · 05-12-2010, 04:54 PM

Hi,

I guess the certificate/key are correct. The fact is that you are talking http to the ssl vhost.
Maybe you haven't enable the ssl vhost, or miss the

Code:

NameVirtualHost *:443

in your configuration.

Regards