0

I've been trying to get SSL to work but I'm stuck. I tried several solutions offered here and on other Google results but no luck.

I got a free certificate from https://www.startssl.com/, Im using a Windows server, client is Firefox (code ssl_error_rx_record_too_long, other browsers give something less informative). I am trying to use Django but the request never makes it to the server so I think that's unrelated; nothing is displayed in the console. Apache shows no errors for httpd.

The http (not https) version of the site is working normally. Adding :443 to the https request does not change the error.

The (I think) relevant part of httpd config is:

Listen 80

LoadModule ssl_module modules/mod_ssl.so

DefaultType text/plain

<IfModule ssl_module>
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
</IfModule>

Listen 443

NameVirtualHost 85.223.64.8:80
Include "C:/Users/Mark/Web/Apache/httpd.conf.incl"

<VirtualHost _default_:443>
    # Include expanded
    LogLevel warn
    ErrorLog "path/secure.error.log"

    DocumentRoot "path/www"
    ServerName django.mverleg.nl
    ServerAdmin postmaster@mverleg.nl
    ServerAlias *.django.mverleg.nl
    ProxyPreserveHost On
    ProxyRequests Off

    SSLEngine on

    SSLSessionCache 'shmcb:path/ssl_scache(512000)'
    SSLSessionCacheTimeout 300

    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM

    SSLCertificateFile "path/ssl.crt"
    SSLCertificateKeyFile "path/ssl.key"
    SSLCertificateChainFile "path/sub.class1.server.ca.pem"
    SSLCACertificateFile "path/ca.pem"

    <Location />
        UseCanonicalName Off
        ServerSignature Off
        AddDefaultCharset utf-8
        ProxyPass http://127.0.0.1:8081/
    </Location>
</VirtualHost>

Running test for httpd gives nothing. Error log when restarting:

The Apache2.2 service is restarting.
Starting the Apache2.2 service
The Apache2.2 service is running.
Init: Session Cache is not configured [hint: SSLSessionCache]
httpd.exe: Could not reliably determine the server's fully qualified domain name, using 85.223.64.8 for ServerName
[Wed Jan 04 01:39:58 2012] [notice] Digest: generating secret for digest authentication ...
[Wed Jan 04 01:39:58 2012] [notice] Digest: done

After which htppd.exe is not running (and hence no errors or response on page request).

If I comment the VirtualHost part, the next line after the above is:

[Wed Jan 04 01:41:52 2012] [notice] Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.21 OpenSSL/0.9.8l configured -- resuming normal operations

Any help would be greatly appreciated. I thought everything is set up according to various guides I found so I can't see what's wrong (admitted I don't know much about SSL or httpd settings).

Updated version already implementing some of the suggestions below and show error.

Unbelievable, it broke again... Http sites were working and https site was saying identity could not be verified (which is a step forward I guess). Then I restart the server and back to the old situation (nothing accessible). I reverted the changed (I think so...) and it's still broken. Any chance this is related to caching or storing keys or something like that, as it worked for a while when I added the new mod_ssl? None of this makes any sense, it's driving me crazy... Any ideas? Got a new error:

[Wed Jan 04 03:30:45 2012] [crit] (OS 18)There are no more files.  : master_main: create child process failed. Exiting.
Improve this question
3
  • Check in the Apache error_log for some additional information about this request.
    – Stefan Lasiewski
    Jan 3, 2012 at 20:31
  • Is this all of the configuration? On most instances in Linux, the main httpd.conf file includes a subdirectory with additional configuration. There is usually one for SSL there. conf.d/ssl.conf. Not sure about Windows builds... Also, the suggestion to check error_log is misguided, as ssl_error_log is usually seperate. Again, unsure about Apache under Windows. Lastly, take care of the error about your FQDN by providing it in your hosts file.
    – Aaron Copley
    Jan 4, 2012 at 0:57
  • Yeah there was an include but I hadn't enabled it. I fixed the domain name thing, thanks!
    – Mark
    Jan 4, 2012 at 2:12

3 Answers 3

Reset to default
2

SSL clearly isn't enabled at the minute on that IP address on port 443 (http://85.223.64.8:443/ works as plain HTTP).

Please double check you have enabled mod_ssl (via LoadModule somewhere in your configuration, depending on what you're using).

If you haven't specified an NameVirtualHost directive, try using <VirtualHost _default_:443> instead of specifying your IP address.

Improve this answer
3
  • Thanks for the advice, I have NameVirtualHost now (with IP cause I think that's what I'll need if other sites are added later). Another problem appeared, I'll update the question.
    – Mark
    Jan 3, 2012 at 20:04
  • You shouldn't need NameVirtualHost here. Multiple HTTPS sites together will cause other problems (especially if you try to run them on the same IP address).
    – Bruno
    Jan 3, 2012 at 20:17
  • I added the default but regretably no improvement :-(
    – Mark
    Jan 4, 2012 at 0:46
0

Your IfModule line doesn't look right. I believe it should be:

<IfModule mod_ssl.c>
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
</IfModule>

Not:

<IfModule ssl_module>
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
</IfModule>
Improve this answer
2
  • According to the IfModule documentation, either the module name or the source file name can be used. It shouldn't matter.
    – Bruno
    Jan 3, 2012 at 14:15
  • Well look at that! I still learn something new every day. Thanks!
    – mahnsc
    Jan 3, 2012 at 14:26
-1

Not sure, but ProxyPassReverse / http://127.0.0.1:8082/ could help (docs at http://httpd.apache.org/docs/2.1/mod/mod_proxy.html#proxypassreverse ).

Improve this answer
1
  • I looked it up, I think it is for rewriting headers in content you send to the client, right? I'm not really sure for what to use this, could you please explain?
    – Mark
    Jan 3, 2012 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.