1

after installing an ssl cert (using ssl.conf) apache won't restart and only gives these warns in the log:

[Wed Aug 14 14:16:46 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Aug 14 14:16:46 2013] [notice] SSL FIPS mode disabled

Using Cent OS 6.4

Full log (with loglevel debug) :

[Thu Aug 15 12:54:00 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Aug 15 12:54:00 2013] [info] Init: Seeding PRNG with 256 bytes of entropy
[Thu Aug 15 12:54:00 2013] [notice] SSL FIPS mode disabled
[Thu Aug 15 12:54:00 2013] [info] Init: Generating temporary RSA private keys (512/1024 bits)
[Thu Aug 15 12:54:00 2013] [info] Init: Generating temporary DH parameters (512/1024 bits)
[Thu Aug 15 12:54:00 2013] [info] Init: Initializing (virtual) servers for SSL

And STRACES results on paste bin :

http://pastebin.com/KE4Pe5vF

2
  • - Take a look at the content of the virtualhost error log file. - Check that the certificate and the key have the same modulus. / I had the exact same output on the main error_log file. But I also had this error in the virtualhost error file: "Unable to configure RSA server private key" and "certificate routines:X509_check_private_key:key values mismatch". The error was because the private key that was being loaded in the VirtualHost section of the .conf file didn't match the SSL Certificate being loaded in the same section. Mar 10, 2014 at 13:35
  • Did you check your private key and certificate? Are they pairing?
    – efesaid
    Mar 21, 2015 at 6:52

2 Answers 2

1

Do the following to fix this -

#hostname

This should give your hostname.

Edit the /etc/hosts file and add the following line

your_ip_address your_hostname

Restart apache

1
  • 1
    Yeah I did that and also updated servername in httpd conf (this got rid of the httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName error) but still fails to start. Aug 15, 2013 at 15:32
0

just a short feedback: check your server certificates. I have regenerated my keys again and now it works.

  1. Generate a Private Key
openssl genrsa -des3 -out server.key 1024
  1. Generate a CSR (Certificate Signing Request)
openssl req -new -key server.key -out server.csr
  1. Remove Passphrase from Key
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key
  1. Generating a Self-Signed Certificate
openssl x509 -req -days 1365 -in server.csr -signkey server.key -out server.crt
  1. Installing the Private Key and Certificate
cp server.crt /etc/pki/tls/certs/ssl.crt
cp server.key /etc/pki/tls/private/ssl.key

Now it should work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .