0

I'm experiencing issues with the configuration of mod_ssl on an AWS EC2 instance

It appears I'm at some point where I cannot run httpd service via sudo service httpd restart since I installed the mod24_ssl. I've got no Syntax errors, just a FAILED response when I try to restart httpd :

[ec2]$ sudo service httpd restart
Stopping httpd:    [FAILED]
Starting httpd:    [FAILED]

And I noticed that when I remove the configurations with 443 vhosts in my custom .conf file and in the ssl.conf file everything runs fine

I already verified that I had the localhost.crt and localhost.key that are specified by default in ssl.conf

Before I installed the mod24_ssl package, those vhosts were working fine, I only got errors like "SSL received a record that exceeded the maximum permissible length", wich could be fixed by installing mod_ssl according to several topics I found

I'm trying to have a working SSL configuration to be able to access local addresses over https, doesn't matter if it really works with well signed certificates.

  • Please provide your apache configuration. Log entries are also helpful. – Gerald Schneider Jun 11 at 17:38
0

As requested, here are my conf files for apache :

/etc/httpd/conf/httpd.conf (auto generated by AWS services)

ServerRoot "/etc/httpd"

Listen 80

Include conf.modules.d/*.conf

User apache
Group apache

ServerAdmin root@localhost

<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error_log"

LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig /etc/mime.types

    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz

    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>

EnableSendfile on

IncludeOptional conf.d/*.conf

/etc/httpd/conf.modules.d/00-ssl.conf (created by installing mod24_ssl package)

LoadModule ssl_module modules/mod_ssl.so

/etc/httpd/conf.d/ssl.conf (created by installing mod24_ssl package)

Listen 443 https

SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog

SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

SSLCryptoDevice builtin
#SSLCryptoDevice ubsec

<VirtualHost _default_:443>

    ErrorLog logs/ssl_error_log
    TransferLog logs/ssl_access_log
    LogLevel warn

    SSLEngine on
    SSLProtocol all -SSLv3
    SSLProxyProtocol all -SSLv3
    SSLHonorCipherOrder on
    #SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    #SSLProxyCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
    #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
    #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
    #SSLVerifyClient require
    #SSLVerifyDepth  10
    #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-5]" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0

    CustomLog logs/ssl_request_log \
              "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

With this conf httpd service won't start, but if I remove the <VirtualHost _default_:443> part, it starts perfectly.


And finaly I watched my log file /var/log/httpd/error_log and the only thing appearing when I try to start the httpd service is :

AH00016: Configuration Failed

With no more informations

Thx for your help !

0

I just found another log file that provide more informations apparently :

[Wed Jun 12 08:31:42.263711 2019] [ssl:emerg] [pid 16968] AH02565: Certificate and private key ip-xx-xx-xx-xx.eu-west-3.compute.internal:443:0 from /etc/pki/tls/certs/localhost.crt and /etc/pki/tls/private/localhost.key do not match
0

I finally solved my problem !

Thx to the log error message, I found a solution to generate a valid certificate, with this command :

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/ssl/certs/localhost.crt

Originaly I was following this article to set up SSL on my EC2 instance : https://docs.aws.amazon.com/fr_fr/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html

In this article, the step to create the certificate tells to use the following commands :

cd /etc/pki/tls/certs
sudo make-dummy-cert localhost.crt

But it seems it's not working (anymore at least)

Thx again for your help, I was so frustrated yesterday I totally forgot to simply consult the logs...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.