The Apache Httpd interface to OpenSSL

learn more… | top users | synonyms

12
votes
5answers
25k views

How to enable TLS 1.1 and 1.2 with OpenSSL and Apache

In light of a growing number of security issues, such as the newly announced Browser Exploit Against SSL/TLS (BEAST), I was curious how we could go about enabling TLS 1.1 and 1.2 with OpenSSL and ...
10
votes
1answer
1k views

Apache2 with SSL do I have to copy VirtualHost blocks?

In Apache2 on ubuntu I have my site listening on 80, and now I want to add SSL. Is there a way to enable the SSLEngine for port 443 so I do not have to copy the entire VirtualHost block? When I do ...
8
votes
2answers
555 views

Why store Apache SSL certificate and private key in separate files?

The Apache mod_ssl documentation for the SSLCertificateFile and SSLCertificateKeyFile directives states that it is 'strongly discouraged' to store a private key and an SSL certificate in the same ...
8
votes
1answer
11k views

How to disable SSLCompression on Apache httpd 2.2.15? (Defense against CRIME/BEAST)

I read about the CRIME attack against TLS Compression (CVE-2012-4929, CRIME is a successor to the BEAST attack against ssl & tls), and I want to protect my webservers against this attack by ...
8
votes
1answer
5k views

How to disable TLS 1.1 & 1.2 in Apache?

I have an Ubuntu 12.04.2 LTS server running Apache 2.2.22 with mod_ssl and OpenSSL v1.0.1. In my vhosts config (everything else within which behaves as I would expect), I have the SSLProtocol line ...
6
votes
2answers
6k views

How to Disable SSLv2 for Apache httpd

I just tested my site on https://www.ssllabs.com/ and it said SSLv2 is insecure and I should disable that along with weak Cipher Suites. How can I disable that? I tried the following but it isn’t ...
6
votes
1answer
575 views

How does Apache interpret multiple SSLRandomSeed sources

In my Apache configuration I have these lines: SSLRandomSeed connect builtin SSLRandomSeed connect file:/dev/random SSLRandomSeed connect file:/dev/urandom 1024 How, exactly, does Apache interpret ...
5
votes
4answers
1k views

How can I configure Apache to use HTTPS for external access but HTTP for internal access?

I have two servers, one a development server that is accessible internally on our company's local network and the other a public-facing web server. The development server hosts several tools that we ...
5
votes
3answers
8k views

Apache: SSLCertificateKeyFile: file does not exist or is empty

I am configuring SSL for Apache 2. My system is Ubuntu Server 10.04 LTS. I have the following settings related to SSL in my vhost configuration: SSLEngine On SSLCertificateKeyFile ...
5
votes
1answer
1k views

Upgrade openssl/mod_ssl on Mac OS X Server?

Context: I'm trying to set up an SVN server on a Mac OS X Server 10.6.7, and I'm running into the “SSL error parse tlsext” issue. I've tried changing the SSLProtocol option as described, but then I ...
4
votes
7answers
34k views

How do I disable MEDIUM and WEAK/LOW strength ciphers in Apache + mod_ssl?

A PCI Compliance scan has suggested that we disable Apache's MEDIUM and LOW/WEAK strength ciphers for security. Can someone tell me how to disable these ciphers? Apache v2.2.14 mod_ssl v2.2.14 This ...
4
votes
1answer
4k views

Install & configure mod_ssl on Amazon EC2 instance

I am trying to support HTTPS traffic with the mod_ssl module on my website. I am running an Amazon EC2 instance for my server. I have installed and configured the basic LAMP packages. However, when I ...
4
votes
1answer
320 views

Apache ServerName uses AlternativeName instead of CommonName

I have recently purchased an SSL Certificate. The CommonName (CN) of the certificate is www.mydomain.com and has several AlternativeNames such as subdomain1.mydomain.com, subdomain2.mydomain.com etc. ...
4
votes
2answers
185 views

Why did git stop working after server disabled SSLv3?

Like most others, our repository server needs to disable SSLv3 (and v2) ASAP. However, doing so seems to break our git-clients -- at least, on RHEL5 (connections from my FreeBSD desktop work fine). ...
4
votes
1answer
1k views

Forcing SSL in Apache without hard-coding the hostname

I think that I have this sorted (thanks mainly to the question How to redirect non-www to www without hardcoding using .htaccess?), but I still don't entirely understand a couple of things. I would ...
4
votes
3answers
853 views

How do I create a custom header from an existing SSL environment variable?

OK I have spent all day on this-- I'm using apache with mod_ssl I'm trying to take an existing environment header, "%{SSL_CLIENT_S_DN_CN}s" which looks like "Lastname Firstname Mi username" and set a ...
4
votes
1answer
1k views

SSL_CLIENT_CERT_CHAIN not being passed to backend server

I have client certificate configured and working in Apache. I want to pass the PEM-encoded X.509 certificates of the client to the backend server. I tried with the SSLOptions +ExportCertData. This ...
4
votes
1answer
295 views

Can apache use a key agent to store private keys for SSL?

For mod_ssl in apache to work, you need your RSA private key on the server. If the key is passphrase protected, you have to enter the passphrase whenever you restart apache. There is ...
4
votes
1answer
2k views

Apache sends plain-text response when accessing SSL-enabled site without HTTPS

I've never encountered something such as this before. I was attempting to simply redirect the page to the HTTPS version if it determined that HTTPS was off, but instead it's displaying an HTML page ...
3
votes
1answer
9k views

Disable SSL / TLS compression in Apache 2.2.x

Is there a way to disable SSL/TLS Compression in Apache 2.2.x when using mod_ssl? If not, what are people doing to mitigate the effects of CRIME/BEAST in older browsers? Related Links: ...
3
votes
3answers
2k views

Problems with multiple SSL on same IP, but only in select clients

I know there are tons of posts about multiple SSL on same IP, but I promise I'm not beating a dead horse. My question is very clear. First, a little background... Our organization has several ...
3
votes
2answers
328 views

YouTrack on Tomcat 7 using SSL

I have a running YouTrack instance deployed using Tomcat 7 and it works fine on http://example.com:8080/youtrack Apache is already configured to support SSL for the main domain (I have .pem file). ...
3
votes
2answers
1k views

Discrepancy in SSL Ciphers between Apache 2.2 and OpenSSL 1.0.1

I'm running up-to-date Ubuntu 12.04 LTS with Apache 2.2.22-1ubuntu1.4 and OpenSSL 1.0.1-4ubuntu5.11. I have configured Apache to use ciphersuites list from ...
3
votes
2answers
4k views

mod_ssl SSLCACertificatePath Proper Usage or What is the Best way to Handle Multiple Acceptable Client Certificate CAs

I am attempting to use the mod_proxy SSLCACertificatePath directive, but I'm a tad bit confused on how to use it properly. Here are two links explaining the SSLCACertificatePath directive: ...
3
votes
2answers
13k views

Session Cache is not configured… why?

I'm running (trying to run, actually) Apache 2.4.2 on Windows Server 2003 R2 32 bit (plus PHP 5.4.5 and OpenSSL 1.0.1c, but I don't think that matters), and I'm getting the following line in the error ...
3
votes
1answer
878 views

mod_spdy problems and speculations

I'm trying out mod_spdy and I've run into a problem - it seems to be incompatible with AJAX requests and mod_php as in this: https://www.modspdy.com/blog/2012/04/15/using-mod_spdy-with-php/ The ...
3
votes
1answer
305 views

Requiring client certificate issued by a specific intermediate CA in Apache

I have a CA hierarchy like this: Root-CA ________|_____________ | | TEST-CA PRODUCTION-CA _____|_____ ...
3
votes
1answer
175 views

Certificates when using cas+apache (mod_auth_cas)

I'm running CAS authentication on one server, and a website that is to be secured on a seperate server on my local network. When I ran both CAS and Apache on the same server, they worked fine. When I ...
3
votes
1answer
2k views

How to tell if SSL session caching is in fact working correctly with Apache 2.2?

We have Apache 2.2.22 running on Ubuntu 12.04. SSL is configured and enabled, with these directives in /etc/apache2/mods-enabled/ssl.conf: SSLSessionCache ...
3
votes
1answer
2k views

Apache SSL reverse proxy to a Embed Tomcat

I'm trying to put in place a reverse proxy for an application that is running a tomcat embed server over SSL. The application needs to run over SSL on the port 9002 so I have no way of "disabling SSL" ...
3
votes
0answers
625 views

Apache 2.2 fails with “unable to write 'random state'” with 2048-bit RSA key (1024-bit works fine)

I'm usually pretty good with Apache and OpenSSL, but this one has me completely baffled. I'm running Apache 2.2.22 and OpenSSL 1.0.1 on a Ubuntu 12.04 LTS Server. I have an IP-based virtual host ...
3
votes
1answer
102 views

is it possible to use KeyChain / ssh-agent with apache?

There are a lots a question (and duplicates) on serverfault asking how restart Apache without the passphrase prompt. Two solutions are proposed : removing the password from the key the apache ...
3
votes
1answer
4k views

Using Https between Apache Loadbalancer and backends

I am using an apache (2.4) server configured as loadbalancer in front of 2 apache servers. It works fine when I use http connections between loadbalancer and backends, however using https does not ...
2
votes
2answers
471 views

Can an SSL certificate be on a single line in a file (no line breaks)?

SSL certificates by default have line breaks after 67 characters. I'm trying to create SSL certificate files using Chef. Essentially I want to create the entire certificate file from a string variable ...
2
votes
2answers
1k views

Building an SSL server farm

I'm interested in building the the architecture in the article referenced below. I currently have a modestly-priced layer-4 load balancer and my application servers are the SSL endpoints. I want to ...
2
votes
1answer
2k views

CentOS6 - Apache2 working but when installing / enabling SSL, server won't start because of permissions error

I'm attempting to install Apache with SSL on CentOS6 to use as a development server. I've been following the directions posted here to get SSL working: http://wiki.centos.org/HowTos/Https (Note: ...
2
votes
2answers
85 views

Disabling Apache Directives That Don't Have an “Off” Value

I want certain Apache directives, like SSLCACertificateFile, to be enabled in some Locations, but disabled in others. For example, # Require client certificates for http://example.com/secure ...
2
votes
1answer
219 views

apache client certificate if-else condition

I have a <Location> within a virtualhost that looks like this: <Location /app1/> SSLVerifyClient require SSLVerifyDepth 2 SSLRequireSSL SSLOptions +OptRenegotiate ...
2
votes
1answer
99 views

How to install mod_ssl with minimum effect on a running site

I just took over an old Apache httpd site that was maintained by somebody else. It's running httpd 2.2.2-1.3 on Fedora 5. I think the httpd was originally installed from an RPM. I was asked to enable ...
2
votes
2answers
4k views

Client certificate authentication sslv3 alert handshake failure when Location directive is set

I am trying to setup Client Certificate Authentication for a web service that is running on Rails. The service is running on apache2, passenger, and mod_ssl. I have been able to successfully generate ...
2
votes
1answer
990 views

Apache certificates for some urls not working

We are having a rather strange problem with a Apache-installation. Here is a short summary: Currently I'm setting up Apache with https, and server-certificates. This is fairly easy and works straight ...
2
votes
2answers
9k views

SSL over non-standard port?

I have two different sites in one server: a.com and b.com. If I use named virtualhost on ssl port, IE won't work. So, I decided to use port 444 for SSL for b.com. However, it seems all browsers ...
2
votes
1answer
118 views

Apache (mod_ssl) not delivering SSL Certificates when requested

Houston, I have a problem. I have an instance of Apache (httpd) on one machine using mod_ssl with openssl and mod_jk pointing at several tomcat instances on other physical machines. Apache is really ...
2
votes
2answers
1k views

Apache and mod_ssl working with multiple remote CA for client certs

Generating client certificates by becoming your own CA with an Apache web server is trivial work and there's plenty of documentation out there on how to achieve this. My problem is slightly different. ...
2
votes
0answers
26 views

mod_ssl client certificates on a reverse proxy

I am trying to add client certificate authentication on a reverse proxy that proxies an oracle application. Before adding, and if i remove the subsequent code, the oracle application is able to start ...
2
votes
1answer
490 views

SHA-2 signed SSL certificate crashes apache on startup on CentOS 5.X

In preparation of the warnings that are going to start showing up in browsers when visiting SSL sites with SHA1 signed certificates, I wanted to get all of the certs that I have upgraded. Some of ...
2
votes
3answers
1k views

SSL URL gives a 404

I have recently created an SSL cert on my server *.key and a *csr file. I then created the *crt and the *.ca-bundle with Comodo. I have 2 current vhosts: vhost for - http://www.example.com ...
2
votes
1answer
1k views

SSLVerifyClient require in .htaccess on shared host—CVE-2009-3555 mitigation woes

After some research I got the idea that I can't use SSLVerifyClient successfully anywhere except within a server context because of current CVE-2009-3555 mitigation efforts. Specifically, because of ...
1
vote
2answers
967 views

Yum Update Failing mod_ssl and glibc_devel

Any ideas on how to get this to not fail? # yum update Freeing read locks for locker 0x82: 4189/140342084876032 Freeing read locks for locker 0x84: 4189/140342084876032 Freeing read locks for locker ...
1
vote
2answers
3k views

SSLCertificateChainFile Deprecation Warning on Apache 2.4.8+

We have an SSL Certificate for our website from Network Solutions. After upgrading Apache/OpenSSL to version 2.4.9, I now get the following warning when starting HTTPD: AH02559: The ...