Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I setup wildcard SSL certificate from Godaddy on Apache2. Whenever the server restarts it asks for the passphrase for the SSL certificate's private key.

What's the best way to remove this obstacle to restarts, because when logfile rotation restart occurs in the middle of the night, the server doesn't come back up, and I get an unhappy client call in the morning, as it is a shared server.

share|improve this question
1  
While the actual question has been answered, let me add: Logfile rotation does not require a restart. A reload will be fine and won't require you to present any credentials. –  Jan Jungnickel Oct 4 '09 at 9:33
    
Thanks Jan - good point - I'm actually not sure why the slice is restarting -- seems to happen about 1x week I need to dig in more to figure out why –  ryw Oct 5 '09 at 1:10

3 Answers 3

up vote 18 down vote accepted

To make apache receive the passphrase everytime it restarts, add this to the httpd.conf:

SSLPassPhraseDialog exec:/path/to/passphrase-file

in your passphrase-file:

#!/bin/sh
echo "passphrase"
share|improve this answer
    
thanks - this did it for me –  ryw Oct 5 '09 at 1:09
1  
worked for me too! :D –  markcial Sep 1 '10 at 8:57
1  
Remember to set proper permissions on the script containing the passphrase, otherwise you've effectively removed any security that having the passphrase gave you. (You should also set proper permissions on the key, as described in Max's answer). –  voretaq7 Feb 24 '12 at 23:23

You need to remove encryption from your private key file like this:

openssl rsa -in server.key -out server.key.new

mv server.key.new server.key

Make sure the new key file is only readable by root - otherwise anyone with shell access to this server will be able to grab the private key and impersonate your server.

To make the key readable only by root, do 'chmod 600 server.key.new' before swapping keys.

share|improve this answer
    
i tried your idea, still get challenge on sudo ./apache2 restart :( –  ryw Oct 3 '09 at 19:02
2  
+1 because that's not an "idea", it's an actual procedure –  codehead Oct 3 '09 at 20:01
    
i used term "idea" because it didn't work for me. –  ryw Oct 5 '09 at 1:02
    
how does the passphrase make a ssl certificate more secure if you can remove it that easy without requirering the passphrase ? (or does it ask you for the passphrase ?) –  user2693017 Mar 12 at 21:15

I'd go with the second solution though is not complete. (It should show how to make it readable by root not only state that). The reason is that you should not store passwords in clear text anywhere in your system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.