The Apache Httpd interface to OpenSSL

learn more… | top users | synonyms

3
votes
1answer
1k views

Apache sends plain-text response when accessing SSL-enabled site without HTTPS

I've never encountered something such as this before. I was attempting to simply redirect the page to the HTTPS version if it determined that HTTPS was off, but instead it's displaying an HTML page ...
1
vote
0answers
40 views

How can I relax SSL requirements inside a specific folder?

I have a root folder that is protected by a SSLRequire rule; say: SSLRequire %{SSL_CLIENT_S_DN_Email} =~ m/^.+@foobar\.com$/ However, I'd like a subfolder of this root folder to be protected by a ...
1
vote
1answer
1k views

Self signed Apache cert error: asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag

Can anyone see where I went wrong on these steps (on Windows XP + Apache 2.2)? I tried to create my own self signed SSL certificate with my own CA and when its all done my Apache server wont start ...
0
votes
1answer
84 views

Can't copy Ilias-folder via FQDN, but via ip-address?

I have an Ilias-Installation, which is available through two virtual hosts: the FQDN and the ip-address. The first server is ssl only, the second plain http. Both configuration files look the same ...
1
vote
1answer
2k views

How to setup multiple Apache SSL sites using multiple IP addresses

How do you setup a single Apache2 config to host multiple HTTPS sites each on their own IP address? There will also be multiple HTTP sites on just a single IP address. I do not want to use Server ...
4
votes
1answer
212 views

Can apache use a key agent to store private keys for SSL?

For mod_ssl in apache to work, you need your RSA private key on the server. If the key is passphrase protected, you have to enter the passphrase whenever you restart apache. There is ...
1
vote
1answer
860 views

SSLVerifyClient not working in Directory context

According to Apache documentation about SSLVerifyClient, one can define its value in Directory context. However, the following configuration is not working: <IfModule mod_ssl.c> ...
11
votes
4answers
16k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
1
vote
2answers
2k views

Apache won't start after installing mod_ssl on CentOS

I need to run both http and https on the same hostnames on my server. I had everything running without SSL with hosts configured in the /etc/httpd/conf.d directory. System: CentOS release 5.6 ...
1
vote
3answers
494 views

Moving SSL certificate to another Apache server

We just setup new Windows machine as a web server, with Apache 2.2.19 with openssl installed and we want to move our existing web including the SSL certificate (Verisign) from the old setup, Linux, ...
0
votes
1answer
80 views

Verify and authenticate digital certificates from trusted CA with Apache+mod_ssl

I set a test server with a self signed SSL certificate and http-authentication with personal digital certificates issued by my test CA and everything works fine. What if I want to authenticate users ...
1
vote
1answer
366 views

apache2 SSL Diffie Hellman key sizes

How to make apache 2.2 in debian lenny use Diffie Hellman key exchange with keys larger than 1024bits? I found a patch that theoretically adds this ability at Apache bugzilla but can't find any ...
2
votes
1answer
183 views

apache client certificate if-else condition

I have a <Location> within a virtualhost that looks like this: <Location /app1/> SSLVerifyClient require SSLVerifyDepth 2 SSLRequireSSL SSLOptions +OptRenegotiate ...
1
vote
3answers
294 views

Apache not starting, nothing in log files despite being “debug” level

Our cloud hosting company decided today to upgrade all CentOS implementations to 2.6.39.2. Unfortunately this had an adverse affect on our Apache server, preventing it from starting with mod_ssl ...
0
votes
1answer
100 views

Apache SSL certificate used branch on hostname

I have mass virtual hosting set up on one of our servers allowing me to basically create a symlink in a certain directory and immediately have that host available on both http as well as https. This ...
1
vote
2answers
358 views

Trouble renewing my SSL certificate

So my free SSL certificate from startcom expired, and I went to renew it. I was given a choice of pasting in the contents of my csr, or generating a new one on their website, so I pasted in my csr. ...
1
vote
0answers
327 views

Apache, mod_ssl, mod_jk, tomcat and client certificates filtering

I am working on a very specific apache+mod_ssl+mod_jk+tomcat So far, a basic configuration works as I want: accessing my webapps behind all that stuff works great. I am using a wildcard certificate ...
0
votes
1answer
2k views

OpenSSL Handshake Failure (14094410) - Erroneous Client Certificate Check from Mobile Phone

I'm running a proxy server through Apache with modssl, which we're using to proxy POSTs from mobile devices to another internal server. This works successfully for most clients, but requests from a ...
0
votes
1answer
434 views

How to include mod_ssl into httpd on rhel5.4

I'm trying to get apache running over https with mod_ssl on a rhel 5.4 x64 machine. I don't have mod_ssl.so in the modules directory, nor can i find any ssl type output from httpd -M or httpd -l. ...
3
votes
3answers
2k views

Problems with multiple SSL on same IP, but only in select clients

I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background... Our organization has several ...
3
votes
1answer
291 views

Apache ServerName uses AlternativeName instead of CommonName

I have recently purchased an SSL Certificate. The CommonName (CN) of the certificate is www.mydomain.com and has several AlternativeNames such as subdomain1.mydomain.com, subdomain2.mydomain.com etc. ...
0
votes
2answers
179 views

Why is apache with mod_ssl configured for one VirtualHost responding to requests to any domain?

I've just setup Apache 2.2.18 with mod_ssl enabled and its configured to listen to one IP address on port 443. There are many domains with A DNS record poiting to this IP address. But I want to ...
5
votes
1answer
747 views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
2
votes
1answer
94 views

How to install mod_ssl with minimum effect on a running site

I just took over an old Apache httpd site that was maintained by somebody else. It's running httpd 2.2.2-1.3 on Fedora 5. I think the httpd was originally installed from an RPM. I was asked to enable ...
1
vote
1answer
1k views

REMOTE_USER = SSL_CLIENT_S_DN_CN under x509 with +FakeBasicAuth in Apache. Is it possible?

Hi I'm trying to incorporate a software to our intranet services (BackupPc) This Software uses the environment variable REMOTE_USER to get the username. Placed under an Apache 2.2 server with Client ...
2
votes
2answers
3k views

mod_ssl SSLCACertificatePath Proper Usage or What is the Best way to Handle Multiple Acceptable Client Certificate CAs

I am attempting to use the mod_proxy SSLCACertificatePath directive, but I'm a tad bit confused on how to use it properly. Here are two links explaining the SSLCACertificatePath directive: ...
2
votes
1answer
863 views

SSLVerifyClient require in .htaccess on shared host—CVE-2009-3555 mitigation woes

After some research I got the idea that I can't use SSLVerifyClient successfully anywhere except within a server context because of current CVE-2009-3555 mitigation efforts. Specifically, because of ...
1
vote
2answers
1k views

Apache ProxyPass with SSL

I have a QA setup that consists of multiple internal development servers and one world-accessible provisioning machine that is setup to proxy pass the web traffic. Everything works fine for non-SSL ...
0
votes
1answer
3k views

How can I install mod_ssl on an existing Apache2 installation without recompiling Apache

Updated question Older question Is mod_ssl not for versions of Apache over 1.3.41? I've got version 2.2.17 (currently latest) http://www.modssl.org/ Original question ./configure ...
1
vote
2answers
773 views

Apache SSL Log Incomplete SSL Handshake

Scenario: We're running some experiments in our classroom around trusted connections and SSL, and I want to demonstrate the SSL handshake request on a man-in-the-middle attack. I have an Apache ...
1
vote
1answer
521 views

Apache SSL for login and NON-SSL for everything else (.htacces)

I've almost figured it out on my own but there's something I'm missing. I want to set a couple of directories and files to require SSL and everything else that's not related to those files and dirs to ...
-1
votes
1answer
1k views

apache2: ssl_error_rx_record_too_long when visiting port 80?

I have an Ubuntu 10 x64 server edition machine. I got a second IP and configured /etc/network/interfaces like so (actual IPs and gateways removed): auto lo iface lo inet loopback #iface eth0 inet ...
0
votes
3answers
298 views

PCI scan findings and problems with week ciphers on ports 993, 443, 995, 465

From PCI scan results: Synops is : The remote service encrypts traffic using a protocol with known weaknesses . Description : The remote service accepts connections encrypted using SSL ...
0
votes
1answer
187 views

What do I need for SSL?

just a quick question, I'm kind of confused. I've had set-up my own certification authority and I can create requests and signed them. But, I'm not sure, what I need to give to Apache, currently I've ...
0
votes
1answer
222 views

Are apache2 mod_ssl BIO dumps sensitive?

When apache2 is serving https using mod_ssl, and running with 'LogLevel debug', it frequently logs lines like this, followed by a hex dump: ssl_engine_io.c(1882): OpenSSL: read 518/518 bytes from ...
0
votes
1answer
623 views

Apache, SSL, UCC not working on CN but works on subjectAltName

I recently generated a UCC for domain1.com *.domain1.com domain2.com *.domain2.com now when i visit http://domain1.com in Firefox i get: domain1.com uses an invalid security certificate. The ...
0
votes
1answer
838 views

Apache, SSL, Self signed, Multidomain Certificates

Target: Generate a single SSL Certificate thats valid for domain1.com *.domain1.com domain2.com *.domain2.com Let it be self signed or a locally-generated CA signed. Scenario 1 # ssl.conf [ ...
2
votes
2answers
3k views

Client certificate authentication sslv3 alert handshake failure when Location directive is set

I am trying to setup Client Certificate Authentication for a web service that is running on Rails. The service is running on apache2, passenger, and mod_ssl. I have been able to successfully generate ...
1
vote
1answer
2k views

502: proxy: pass request body failed

Sometimes I get the following error (in apache's error.log) when viewing my site over https: (502)Unknown error 502: proxy: pass request body failed to xxx.xxx.xxx.xxx:443 I'm not entirely sure what ...
1
vote
2answers
1k views

Validating SSL clients using a list of authorised certificates instead of a Certificate Authority

Is it possible to configure Apache (or any other SSL-aware server) to only accept connections from clients presenting a certificate from a pre-defined list? These certificates may be signed by any CA ...
2
votes
6answers
24k views

How do I disable MEDIUM and WEAK/LOW strength ciphers in Apache + mod_ssl?

A PCI Compliance scan has suggested that we disable Apache's MEDIUM and LOW/WEAK strength ciphers for security. Can someone tell me how to disable these ciphers? Apache v2.2.14 mod_ssl v2.2.14 This ...
0
votes
1answer
784 views

Compiling Apache mod_ssl for different target hardware (hardware capability unsupported SSE2 error)

I am building and packaging the following on one machine (the "build" machine) and attempting to install and use on other machines ("target" machines) some of which have different processors. ...
7
votes
1answer
904 views

Apache2 with SSL do I have to copy VirtualHost blocks?

In Apache2 on ubuntu I have my site listening on 80, and now I want to add SSL. Is there a way to enable the SSLEngine for port 443 so I do not have to copy the entire VirtualHost block? When I do ...
2
votes
2answers
1k views

Apache and mod_ssl working with multiple remote CA for client certs

Generating client certificates by becoming your own CA with an Apache web server is trivial work and there's plenty of documentation out there on how to achieve this. My problem is slightly different. ...
5
votes
4answers
1k views

How can I configure Apache to use HTTPS for external access but HTTP for internal access?

I have two servers, one a development server that is accessible internally on our company's local network and the other a public-facing web server. The development server hosts several tools that we ...