3

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded.

Some of my infrastructure is running on "legacy" CentOS 5.X based servers. And on those servers, when I install the new keys and certs, apache simply dies on startup. There is nothing useful in the error_log.

Now, DigiCert has a compatibility page that says that for apache, the following versios are required.

httpd 2.0.63+ w/ OpenSSL 0.9.8o+

on a CentOS 5.X server, with those packages fully updated updated I see this...

httpd.x86_64  2.2.3-91.el5.centos
openssl.x86_64 0.9.8e-27.el5_10.4

So right off the bat I'm thinking that 0.9.8e might be an issue. But I did a little digging to see if the SHA related changes introduced in 0.9.8o of the upstream openssl project were backported by RH, and it DOES look as if SHA256 related changes were committed in one of the RHEL/CentOS backports.

I looked in the git repo for openssl, and found what looks like the SHA 2 related change in 0.9.8o

Commit Hash: bc06baca76534abc2048a3ac4d109b144da4b706
Add SHA2 algorithms to SSL_library_init(). Although these aren't used
directly by SSL/TLS SHA2 certificates are becoming more common and
applications that only call SSL_library_init() and not
OpenSSL_add_all_alrgorithms() will fail when verifying certificates.

And in the CentOS/RHEL openssl pacakge I see this in the changelog...

rpm -q --changelog openssl 
* Wed Mar 09 2011 Tomas Mraz <[email protected]> 0.9.8e-18
- add SHA-2 hashes in SSL_library_init() (#676384)

So, to me, it seems as though I should have the proper versions of httpd and openssl (with backported fix) to handle SHA-2 signed certs.

So my questions. Am I missing something? Is there some other apache misconfiguration that could be causing the crash when starting up with this cert in place?

If I MUST download a newer version of openssl 0.9.8X and go outside of yum, I can do that but I want to avoid that if possible.

2
  • Update: I originally thought I could reproduce this problem on a clean centos vm. But i actually had a problem there. So I'm pretty confident that SHA2 is supported with these packages. However, I still have the same problem in my production environment, so now it's narrowed down to the apache config. Still can't figure it out.
    – Steakfest
    Oct 7, 2014 at 13:28
  • Edit to above... I originally thought I could reproduce this problem on a clean centos vm. But i actually had a DIFFERENT problem there, and was able to get the same cert to work on a clean centos 5 vm with updated apache and openssl. So I'm pretty confident that SHA2 is supported with these packages. However, I still have the same problem in my production environment, so now it's narrowed down to the apache config. Still can't figure it out.
    – Steakfest
    Oct 7, 2014 at 13:37

1 Answer 1

1

Answering my own question...

Yes, CentOS 5 DOES support SHA256 signed certs. A Clean VM works just fine, there must be an apache configuration problem.

There is nothing useful in the error_log...

Take a closer look at your ssl_error_log there isn't anything useful regarding apache halts due to ssl stuff in the error_log. By default apache uses ssl_error_log...

I suspect :) that you will find that there is some problem with the apache configuration.

1
  • took a closer look at the ssl error log and yes, there was a line with... SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch... Dug deeper into the apache config and realized that one of the apache config files that I was making changes to and uploading to the server was actually being Included with a DIFFERENT PATH than what I was expecting.
    – Steakfest
    Oct 7, 2014 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .