Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

after installing an ssl cert (using ssl.conf) apache won't restart and only gives these warns in the log:

[Wed Aug 14 14:16:46 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Aug 14 14:16:46 2013] [notice] SSL FIPS mode disabled

Using Cent OS 6.4

Full log (with loglevel debug) :

[Thu Aug 15 12:54:00 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Aug 15 12:54:00 2013] [info] Init: Seeding PRNG with 256 bytes of entropy
[Thu Aug 15 12:54:00 2013] [notice] SSL FIPS mode disabled
[Thu Aug 15 12:54:00 2013] [info] Init: Generating temporary RSA private keys (512/1024 bits)
[Thu Aug 15 12:54:00 2013] [info] Init: Generating temporary DH parameters (512/1024 bits)
[Thu Aug 15 12:54:00 2013] [info] Init: Initializing (virtual) servers for SSL

And STRACES results on paste bin :

http://pastebin.com/KE4Pe5vF

share|improve this question
    
- Take a look at the content of the virtualhost error log file. - Check that the certificate and the key have the same modulus. / I had the exact same output on the main error_log file. But I also had this error in the virtualhost error file: "Unable to configure RSA server private key" and "certificate routines:X509_check_private_key:key values mismatch". The error was because the private key that was being loaded in the VirtualHost section of the .conf file didn't match the SSL Certificate being loaded in the same section. –  Céline Aussourd Mar 10 '14 at 13:35
    
Did you check your private key and certificate? Are they pairing? –  efesaid Mar 21 at 6:52

2 Answers 2

Do the following to fix this -

#hostname

This should give your hostname.

Edit the /etc/hosts file and add the following line

your_ip_address your_hostname

Restart apache

share|improve this answer
1  
Yeah I did that and also updated servername in httpd conf (this got rid of the httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName error) but still fails to start. –  frank_texti Aug 15 '13 at 15:32

just a short feedback: check your server certificates. I have regenerated my keys again and now it works.

  1. Generate a Private Key
openssl genrsa -des3 -out server.key 1024
  1. Generate a CSR (Certificate Signing Request)
openssl req -new -key server.key -out server.csr
  1. Remove Passphrase from Key
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key
  1. Generating a Self-Signed Certificate
openssl x509 -req -days 1365 -in server.csr -signkey server.key -out server.crt
  1. Installing the Private Key and Certificate
cp server.crt /etc/pki/tls/certs/ssl.crt
cp server.key /etc/pki/tls/private/ssl.key

Now it should work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.