0

First, please let me start this with a "warning" that I'm a newbie with this and am trying to learn on my own. However, my frustrations are mounting and I'm almost ready to completely abandon SSL. (I know that isn't a secure thing to do, but it may be my only choice.)

I have to build a replacement server with varnish and hitch, but have been battling for hours attempting to get hitch to recognize any SSL certificate that I've gotten/generated. (Since this has to be zero cost, I'm using only SSLforFree -- but have even tried my now-expired self-signed SSL from my old varnish/hitch server that needs to be retired.)

I think I have varnish properly running and configured to listen on port 6081 (if I read this line from my netstat output correctly) --

tcp        0      0 0.0.0.0:6081            0.0.0.0:*               LISTEN      6059/varnishd

..... and I think the new hitch.conf file looks right (the .pem filename is masked over, but I confirmed it does exist with 644 permissions) --

[root@cache2 pem]# cat /etc/hitch/hitch.conf
# Run 'man hitch.conf' for a description of all options.
pem-file = "/var/pem/xxxxxxx.com.pem"

frontend = {
    host = "*"
    port = "443"
}

backend = "[127.0.0.1]:6081"    # 6086 is the default Varnish PROXY port.
workers = 1                     # number of CPU cores
daemon = on

# We strongly recommend you create a separate non-privileged hitch
# user and group
user = "hitch"
group = "hitch"

# Enable to let clients negotiate HTTP/2 with ALPN. (default off)
# alpn-protos = "h2, http/1.1"

# run Varnish as backend over PROXY; varnishd -a :80 -a localhost:6086,PROXY ..
write-proxy-v2 = on             # Write PROXY header

but when I "hitch -t", I get --

No x509 certificate PEM file specified for frontend 'default'!

I know I'm doing something wrong, but I haven't yet found anything on-line to help me troubleshoot the problem. Since my old self-signed SSL .pem file didn't work either (and it works fine on my old server), I'm pretty sure I botched the hitch config.

My "Thanks!" in advance for any and all help.

  • 1
    Why don't you just reuse the config from the old server? Or at least compare what you're doing now with what is on the old server? – womble Dec 23 '18 at 6:44
  • The old and new config looked right when I compared them side-by-side. As suggested, I did just scp the old hitch.conf onto the new server, but I got the same error. :-( – John T Dec 24 '18 at 18:04
  • Probably different versions of the software with different behaviour, then. – womble Dec 25 '18 at 6:23
1

Did you add the key to the cert file ?

Check that each element of the path to the file xxxxxxx.com.pem will has permissions (execute) that will allow the user hitch to traverse it. The /var directory should be correct at 755. Yow could set 755 on pem but a better solution would be to change the group ownership to hitch and set 750 permissions.

Once you get it working you should also change the ownership of the xxxxxxx.com.pem and configyre suitable permissions so that it does not need to be world readable.

  • I just confirmed 755 from / to the .pem file (which is at 644). I recreated the .pem file with -- cat PrivateKey.key cert.crt ca-chain-20181222.crt >xxxxxxxxx.pem but still get the same error.... Is there a way to find out if I have a bad .pem file vs it just not being properly configured in hitch.conf ? I'm still not 100% sure which of the two is the real problem. Thanks! – John T Dec 24 '18 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.