I am losing my mind due to OpenSSL + Apache. I've checked a lot of resourced, consulted collegues and realised that the best choice at this moment would be to consult other resources (aka you guys).
I wrote software using Python and CherryPy that listerns on port 1240 for HTTP request. However, due to the fact that I need shielding from network inspection I want to wrap this with ssl. We decided to go for ProxyPass with Apache for the SSL instead of Python as it's faster, more reliable and more globally known.
Everything said and done, installed apache. Build a seperate user etc for the service to run so when it gets (cr/h)acked they are jailed in a useles user account. All that jazz.
Now I wrote the following enabled site:
ProxyRequests Off <VirtualHost *:443> ServerName SERVER_NAME ProxyPass / http://127.0.0.1:1240/ ProxyPassReverse / http://127.0.0.1:1240/ <Directory proxy:*> Order Deny,Allow Allow from all </Directory> SSLEngine on SSLCACertificateFile /etc/ssl/certs/MY_CERT.crt SSLCertificateFile /etc/ssl/certs/MY_CERT.crt SSLCertificateKeyFile /etc/ssl/certs/MY_CERT.pem </VirtualHost>
Looks are great, don't it (please note due to Dataleakage I've changed the names of the servername and the certs to capital letters etc. Anyway, even tough it looks great when I connect with firefox I get the following error.
(Error code: ssl_error_rx_record_too_long)
And I thought: "Wait, thats not good".
So I started googling and I found out mod-ssl might not be loaded. Thus I checked like so:
root@SYSTEM:/etc/apache2# apachectl -t -D DUMP_MODULES [Thu Jan 24 09:36:44 2013] [warn] NameVirtualHost *:8080 has no VirtualHosts Loaded Modules: core_module (static) log_config_module (static) logio_module (static) mpm_prefork_module (static) http_module (static) so_module (static) alias_module (shared) auth_basic_module (shared) authn_file_module (shared) authz_default_module (shared) authz_groupfile_module (shared) authz_host_module (shared) authz_user_module (shared) autoindex_module (shared) cgi_module (shared) deflate_module (shared) dir_module (shared) env_module (shared) mime_module (shared) negotiation_module (shared) php5_module (shared) proxy_module (shared) proxy_ajp_module (shared) proxy_balancer_module (shared) proxy_connect_module (shared) proxy_ftp_module (shared) proxy_http_module (shared) proxy_scgi_module (shared) reqtimeout_module (shared) setenvif_module (shared) ssl_module (shared) status_module (shared) Syntax OK
Looks good, moving on. Checking the logs I found the exact same error as on here: http://ubuntuforums.org/showthread.php?t=806884
Tried, didn't work. I regenerated the Keys, however same issue ( http://www.devco.net/archives/2006/02/13/public_-_private_key_encryption_using_openssl.php ) I checked the validity of the keys with openssl:
root@SYSTEM:/etc/ssl/certs# openssl x509 -in MY_CERT.crt -noout -text Certificate: Data: Version: 1 (0x0) Serial Number: <---8<---snip---8<--->(0x<---8<---snip---8<--->) Signature Algorithm: sha1WithRSAEncryption Issuer: <---8<---snip---8<---> Validity Not Before: Jan 24 08:05:44 2013 GMT Not After : Mar 25 08:05:44 2013 GMT Subject: <---8<---snip---8<---> Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (1024 bit) Modulus: <---8<---snip---8<---> Exponent: <---8<---snip---8<---> (0x<---8<---snip---8<--->) Signature Algorithm: sha1WithRSAEncryption <---8<---snip---8<--->
Looks valid, now I am starting to lose hair. Also when I telnet on 443. And I
GET / I get HTML returned. So it looks like SSL isn't running at all. Any tips/tricks for me to try? Documents to review or ANYTHING?
Also, I realise Self-Signing etc isn't the most secure thing out there. But that is not the point now, as it's really just for a Proof-of-Concept at the moment. So any advice would be really useful and I'd reward you with one of those ServerFault +1 post thingys ;)
One more small note, when I use
links https://localhost it works.
STOLAS@SYSTEM:~$ sudo apachectl -S [sudo] password for STOLAS: [Thu Jan 24 10:47:42 2013] [warn] NameVirtualHost *:8080 has no VirtualHosts VirtualHost configuration: wildcard NameVirtualHosts and default servers: *:443 SERVER.COM (/etc/apache2/sites-enabled/000-default:2) Syntax OK