0

When i add SSLEngine on into my vhost setup apache wont start... Any help would be great.

I am doing the following the following to setup SSL on my server:

yum install mod_ssl openssl

key_dir=/home/keys/ssl
mkdir -m 700 -p $key_dir
echo "$SSL_KEY" > $key_dir/ca.key
echo "$SSL_CERTIFICATE" > $key_dir/ca.crt
echo "$SSL_INTERMEDIATE" > $key_dir/intermediate.crt
chmod 400 $key_dir/*

cp $key_dir/ca.crt /etc/pki/tls/certs
cp $key_dir/intermediate.crt /etc/pki/tls/certs
cp $key_dir/ca.key /etc/pki/tls/private/ca.key

The below is the virutal host I have placed at the bottom of /etc/httpd/conf.d/ssl.conf

<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/ca.crt
        SSLCertificateKeyFile /etc/pki/tls/private/ca.key
        SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt
        <Directory /home/webapps/xxxxxx/curret/webroot>
        AllowOverride All
        </Directory>
        DocumentRoot /home/webapps/xxxxxx/current/webroot
        ServerName ssl.xxxxxxx.com
</VirtualHost>

With SSLEngine on apache wont start without it it works fine.

Any suggestions?

UDPATE

I just found this in the apache error log:

[Tue Mar 08 13:32:45 2011] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Mar 08 13:32:45 2011] [error] Init: Private key not found
[Tue Mar 08 13:32:45 2011] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Tue Mar 08 13:32:45 2011] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Mar 08 13:32:45 2011] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Tue Mar 08 13:32:45 2011] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

But the key exists and matches the location in the vhost setup

2
  • can you post the error message that you get when you restart httpd ? Mar 8, 2011 at 13:33
  • I don't get an error message.. But just found error in apache error log - see updated answer
    – icelizard
    Mar 8, 2011 at 13:36

2 Answers 2

1

I fixed it...

I had somehow managed to have the CSR contents as the contents of the KEY file!! Silly me

-3

When you create private key with passphrase, this may cause problem starting apache server.

DO NOT create private key with Passphrase..

1
  • Downvoting because this is wrong. The only effect of putting a passphrase on the private key is that you get prompted to enter the passphrase when you restart the server. Dec 3, 2014 at 10:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .