0

I've got scripts which restart apache so I've been trying to find a way to restart apache without it asking for the ssl passphrase as this means it won't restart in the script.

The two solutions I can think of (without changing the cert) is either feed in the passphrase in the script (which I don't know how to pass) or the solution explained in the documentation here:

https://knowledge.digicert.com/solution/SO14536.html

Except when I try this I get an error when running

systemctl restart httpd

and I get the error message

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

When I look in journalctl I get the following error message (with server info taken out)

-- Unit httpd.service has begun starting up.
 httpd.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit httpd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit httpd.service has failed.
--
-- The result is failed.
 Unit httpd.service entered failed state.
 httpd.service failed.

I have definitely made my passphrase file executable and entered the path correctly

Running systemctl status httpd -l gives the below

● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2020-05-12 16:38:50 BST; 5s ago
     Docs: man:httpd(8)
           man:apachectl(8)
  Process: 53600 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
  Process: 31812 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS)
  Process: 53610 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 53610 (code=exited, status=1/FAILURE)

systemd[1]: Starting The Apache HTTP Server...
httpd.service: main process exited, code=exited, status=1/FAILURE
Failed to start The Apache HTTP Server.
Unit httpd.service entered failed state.
httpd.service failed.

The apache error_log gives the below error message:

[mpm_prefork:notice] [pid 54928] AH00170: caught SIGWINCH, shutting down gracefully
[core:notice] [pid 116252] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[suexec:notice] [pid 116252] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[ssl:error] [pid 116252] AH02246: Init: Unable to read pass phrase [Hint: key introduced or changed before restart?]
[ssl:error] [pid 116252] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[ssl:error] [pid 116252] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[ssl:error] [pid 116252] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[ssl:error] [pid 116252] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[ssl:error] [pid 116252] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[ssl:error] [pid 116252] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[ssl:error] [pid 116252] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)
[ssl:emerg] [pid 116252] AH02312: Fatal error initialising mod_ssl, exiting.

Any idea why this is or any alternate solutions?

  • 1
    Why don't you simply remove the passphrase protection from the key? There is very little advantage in password-protecting the key, and saving the password right next to it, as opposed to having a non-password-protected key. – Lacek May 21 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.