0

I've been hacking up this server for a few days trying to convert a new installation of apache to HTTPS with the plan to convert it to NSS once I have SSL running properly. This server is not internet facing and strictly for use within our internal network, so a self-signed certificate was used. I am sure this is something simple that someone more experienced would quickly spot.

its:/etc/apache2 # httpd -v
Server version: Apache/2.4.23 (Linux/SUSE)
Server built:   2018-04-04 10:24:21.000000000 +0000

This is the command that starts the server with SSL enabled:

its:~ # apache2ctl -D SSL -k start

You can see from the command below that httpd is listening on 80 and 443:

its:~ # netstat -anp | grep -i listen |head -10
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      12704/postgres
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1587/master
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1461/sshd
tcp        0      0 ::1:5432                :::*                    LISTEN      12704/postgres
tcp        0      0 ::1:25                  :::*                    LISTEN      1587/master
tcp        0      0 :::443                  :::*                    LISTEN      17086/httpd-prefork
tcp        0      0 :::80                   :::*                    LISTEN      17086/httpd-prefork
tcp        0      0 :::22                   :::*                    LISTEN      1461/sshd
unix  2      [ ACC ]     STREAM     LISTENING     20198  3246/gnome-session- @/tmp/.ICE-unix/3246
unix  2      [ ACC ]     STREAM     LISTENING     26729  10664/2             /tmp/ssh-QVZiT6g6BZ/agent.10664

This is what is shown in the apache error log when the above command is run:

[Tue Jun 19 18:09:06.548624 2018] [mpm_prefork:notice] [pid 17086] AH00163: Apache/2.4.23 (Linux/SUSE) OpenSSL/1.0.2j-fips PHP/7.0.7 configured -- resuming normal operations
[Tue Jun 19 18:09:06.548653 2018] [core:notice] [pid 17086] AH00094: Command line: '/usr/sbin/httpd-prefork -D SYSCONFIG -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf -D SSL'

Now when trying to start the server normally (without the -D SSL option):

its:~ # apache2ctl start
its:/etc/apache2 # netstat -anp | grep -i listen |head -10
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      12704/postgres
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1587/master
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1461/sshd
tcp        0      0 ::1:5432                :::*                    LISTEN      12704/postgres
tcp        0      0 ::1:25                  :::*                    LISTEN      1587/master
tcp        0      0 :::80                   :::*                    LISTEN      22448/httpd-prefork
tcp        0      0 :::22                   :::*                    LISTEN      1461/sshd
unix  2      [ ACC ]     STREAM     LISTENING     20198  3246/gnome-session- @/tmp/.ICE-unix/3246
unix  2      [ ACC ]     STREAM     LISTENING     26729  10664/2             /tmp/ssh-QVZiT6g6BZ/agent.10664
unix  2      [ ACC ]     STREAM     LISTENING     20051  1911/gdm-simple-sla @/tmp/dbus-UIT8sEpY

And in the apache error log:

[Wed Jun 20 09:00:59.337270 2018] [ssl:warn] [pid 22448] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Wed Jun 20 09:00:59.342902 2018] [mpm_prefork:notice] [pid 22448] AH00163: Apache/2.4.23 (Linux/SUSE) OpenSSL/1.0.2j-fips PHP/7.0.7 configured -- resuming normal operations
[Wed Jun 20 09:00:59.342982 2018] [core:notice] [pid 22448] AH00094: Command line: '/usr/sbin/httpd-prefork -D SYSCONFIG -C PidFile /var/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Include /etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include /etc/apache2/sysconfig.d//include.conf'

I did notice the ssl:warn in the second demonstration above, so here is that research:

its:/etc/apache2 # cat httpd.conf |grep ssl-global.conf |grep -v \#
Include /etc/apache2/ssl-global.conf
its:/etc/apache2 # cat ssl-global.conf|grep SSLSessionCache |grep -v \#
        SSLSessionCache         shmcb:/var/lib/apache2/ssl_scache(512000)
        SSLSessionCacheTimeout  300

httpd.conf:

its:/etc/apache2 # cat httpd.conf |grep -v ^\# |grep -v ^$
Include /etc/apache2/uid.conf
Include /etc/apache2/server-tuning.conf
ErrorLog /var/log/apache2/error_log
<IfDefine !SYSCONFIG>
  Include /etc/apache2/loadmodule.conf
</IfDefine>
Include /etc/apache2/listen.conf
Include /etc/apache2/mod_log_config.conf
<IfDefine !SYSCONFIG>
  Include /etc/apache2/global.conf
</IfDefine>
Include /etc/apache2/mod_status.conf
Include /etc/apache2/mod_info.conf
Include /etc/apache2/mod_reqtimeout.conf
Include /etc/apache2/mod_cgid-timeout.conf
Include /etc/apache2/mod_usertrack.conf
Include /etc/apache2/mod_autoindex-defaults.conf
TypesConfig /etc/apache2/mime.types
Include /etc/apache2/mod_mime-defaults.conf
Include /etc/apache2/errors.conf
Include /etc/apache2/ssl-global.conf
<Directory />
    Options None
    AllowOverride None
    <IfModule !mod_access_compat.c>
        Require all denied
    </IfModule>
    <IfModule mod_access_compat.c>
        Order deny,allow
        Deny from all
    </IfModule>
</Directory>
AccessFileName .htaccess
<Files ~ "^\.ht">
    <IfModule !mod_access_compat.c>
        Require all denied
    </IfModule>
    <IfModule mod_access_compat.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
DirectoryIndex index.html index.html.var
Include /etc/apache2/default-server.conf
IncludeOptional /etc/apache2/vhosts.d/*.conf
ServerName 192.168.25.53
AddType  application/x-httpd-php         .php
AddType  application/x-httpd-php-source  .phps

And finally my vhost file:

its:/etc/apache2 # cat vhosts.d/*conf |grep -v \# |grep -v ^$
ServerTokens Prod
TraceEnable off
LogLevel notice
<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost _default_:443>
DocumentRoot /srv/www/htdocs/mantis
ServerName 192.168.25.53
ServerAlias 192.168.25.53
ServerAdmin webadmin@sample.com
ErrorLog "|| /usr/sbin/rotatelogs2 /var/log/apache2/error_log_ssl.%Y%m%d 100M"
TransferLog "|| /usr/sbin/rotatelogs2 /var/log/apache2/access_log_ssl.%Y%m%d 100M"
CustomLog "|| /usr/sbin/rotatelogs2 /var/log/apache2/ssl_request_log.%Y%m%d 100M" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
CustomLog "|| /usr/sbin/rotatelogs2 /var/log/apache2/ssl_referer_log.%Y%m%d 100M" "%t %h %{Referer}i -> %U"
<IfModule mod_rewrite.c>
   RewriteEngine on
   RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
   RewriteRule .* - [F]
</IfModule>
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
SSLCertificateChainFile /etc/apache2/ssl/apache.crt
SSLCACertificatePath /etc/apache2/ssl
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

<Directory "/srv/www/htdocs/mantis">
    Require all granted
    Order allow,deny
    Allow from all
</Directory>
</VirtualHost>
</IfDefine>
</IfDefine>

If there are any other conf or log files I should include to better address this question, please write in the comments below. I am open to any suggestions or best practice methods that might be outside the scope of this question, but please limit those to comments.

1

Apparently in SuSE you need to place this line in /etc/sysconfig/apache2 file:

APACHE_SERVER_FLAGS="-D SSL"

You can see that your configuration file contains a IfDefine, so it's intentionally done this way.

  • 1
    I knew it was something simple. I checked with another server I had running, you are 100% correct. However, I found that I do not need the -D in the sysconfig file. All I needed was APACHE_SERVER_FLAGS="SSL" to make it come up with SSL. Now on to installing NSS and undoing everything I just did. So much fun! – Bill Jun 20 '18 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.