Hot answers tagged

33

Try to run yum install mod24_ssl instead, which I think you've already done. Any packages that have additional versions usually require the version to be specified for any dependencies. So everything for php54 would be prefixed with php54-. If you're ever unsure, you can always do a yum search with some keywords. For example: yum search mod ssl lists the ...


32

Your domain's certificate has two paths to two different root certificate authorities. On modern desktop browsers such as Google Chrome, as well as on newer Android versions, the path being taken is to the more recent USERTrust RSA Certification Authority root certificate. (I get this on Android 7.0 NPD90G.) On older Android versions, the path being taken ...


28

TLS1.2 is now available for apache, to add TLSs1.2 you just need to add in your https virtual host configuration: SSLProtocol -all +TLSv1.2 -all is removing other ssl protocol (SSL 1,2,3 TLS1) +TLSv1.2 is adding TLS 1.2 for more browser compatibility you can use SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2 by the way you can increase the Cipher suite too ...


23

Intrigued by this bug (and yes, I've been able to reproduce it) I've taken a look at the source code for the latest stable version of mod_ssl and found an explanation. Bear with me, this is gonna get amateur-stack-overflowish: When the SSLProtocol has been parsed, it results in a char looking something like this: 0 1 0 0 ^ ^ ^ ^ | | | SSLv1 | | SSLv2 | ...


22

No, the certificate won't be handled properly without the line breaks - software will fail to parse it. If you're trying to pass it in a string, why not just include them in it? (\n)


21

On March 4, 2013, Red Hat provided updated OpenSSL packages which address this issue. You can receive them through your normal update channels. The original answer was: Red Hat has not provided an updated package which provides this functionality, though there is a workaround available. Edit the /etc/sysconfig/httpd file and add this line to it: export ...


17

The problem turned out to be that the certificates common name did not match the server name. Prior to Apache 2.4.5 this check can be disabled using SSLProxyCheckPeerCN off but on higher versions (such as 2.4.7) SSLProxyCheckPeerName off also needs to be specified. Apache documentation for SSLProxyCheckPeerName The working configuration looks like this: ...


15

The SSL Certificate File is a lock. The SSL Certificate Key File is its key. Storing the two together is the equivalent of taping your key to the lock on your front door. If an attacker compromises the single file they have everything they need to successfully impersonate your website (the certificate, and the private key). This is especially true if you ...


14

You can use SSLCompression off if you're on 2.2.24 or later. If not, you can set the OPENSSL_NO_DEFAULT_ZLIB environment variable to force compression off in OpenSSL - see this question.


13

I found this script handful in doing that. awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ca.pem This will take a standard PEM file on multiple lines, replace the "hidden" newline characters with \n, and print the output as a single line. For example, this will make the following PEM file... -----BEGIN CERTIFICATE----- ...


11

I also get the message SSLCertificateKeyFile: file '/path/to/file' does not exist or is empty while /path/to/file exist and have right permissions, just because of SELinux turned on and this file was unaccessable for apache user. It looks like this: $ sudo ls -laZ /etc/pki/tls/certs/ drwxr-xr-x. root root system_u:object_r:cert_t:s0 . drwxr-xr-x. ...


11

Compile apache with the latest version of OpenSSL to enable TLSv1.1 and TLSv1.2 http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslprotocol SSLProtocol +TLSv1.1 +TLSv1.2


10

The solution was very hard to find... Only coincidence helps me to find it. The Apache2.4 requires .conf extension.... I had two files: /etc/apache2/sites-available/http and /etc/apache2/sites-available/https and of course the same symlinks in /etc/apache2/sites-enabled/. Trying to find out the solution I took default-ssl.conf and made it a symlink, and ...


9

I had the same issue. I just replaced these lines in /etc/apache2/site-enabled/default-ssl.conf SSLCertificateFile /etc/ssl/certs/domain.crt SSLCertificateKeyFile /etc/ssl/private/domain.key #SSLCertificateChainFile /etc/apache2/ssl.crt/chain.crt As you see, I just commented out the SSLCertificateChainFile. Then, seeing the same error as you, I ...


9

The question is three months old so my answer may not be needed by the OP but it may help anyone wanting this configuration. The question is tagged apache-2.4 but the configuration looks like one which is appropriate for 2.2. This isn't entirely surprising as many examples in the Apache 2.4 documentation seem themselves not to be appropriate to 2.4. I had ...


9

I think eltrai is on the right path but I would remove the first <VirtualHost> block and use ServerAlias in the second <VirtualHost _default_:443> ServerAdmin admin@localhost ServerName domain.tld ServerAlias www.domain.tld You can add your RedirectMatch later in that same block to redirect from www to non.


8

The stock CentOS httpd & mod_ssl packages would already have supported SNI. SNI has been supported by openssl since version 0.9.8f and any httpd since version 2.2.12 built with openssl 0.9.8f and newer automatically will support SNI. But to check if your httpd and mod_ssl support SNI: Simply test by configuring name based SSL/TLS virtual hosts and ...


7

Old versions of OpenSSL required two separate files (public and private). Old versions of other crypto engines required a single file (both in the same file). In the "spirit" of compatibility (aka "Admin's whinging about the inconsistency and having to maintain two sets of certificates), most now support both. Storing both certificates (also the key chain) ...


6

If you are unsure what ciphers this SSLCipherSuite line ends up permitting, you can run it through openssl: openssl ciphers -v 'HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM' This will give you a list of cipher combinations: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256)...


6

I ran across the same issue. Heres my story and solution: I've been saving the cert as UTF-8 with BOM (Byte order Mark) So you can just open that file with vim and save it without BOM: # vim cert.pem :set nobomb :wq via: https://stackoverflow.com/a/300474


6

I've done this and it helped me on CentOS 5.7 server:~ # chcon -t cert_t /etc/pki/tls/private/my.key server:~ # ls -laZ /etc/pki/tls/private/


6

You need to use the SSL_CLIENT_S_* directives: Require ssl Require ssl-verify-client SSLRequireSSL SSLOptions +FakeBasicAuth +StrictRequire SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 256 SSLRequire %{SSL_CLIENT_S_DN_O} eq "Company, LTD." \ and %{...


6

I use the following script to create a certificate bundle that contains the chained certificate. #!/bin/sh # # Convert PEM Certificate to ca-bundle.crt format # test ! $1 && printf "Usage: `basename $0` certificate" && exit 1 # Friendly Name and Underline Friendly Name with equal signs openssl x509 -in $1 -text -noout | sed -e 's/^ *...


6

Ok, here is the deal. Disabling SSLv3 in today's Apache means, the server would not even tell the client, that it wants to use TLS. If the client does not begin the conversation with TLS, the client will fail -- even if could talk TLS. Many thanks to user Chris S., who analyzed the problem and even offered a patch for Apache's mod_ssl in answering a related ...


6

One more thing to check that wasn't mentioned in the previous answers. If you have "SSLEngine on" anywhere in your global config (basically anywhere outside of the VirtualHost and similar blocks) and you do not have a SSLCertificateFile directive also defined globally, apache will choke on this before it even gets to the virtual host and you will get this ...


5

It seems that an SSL certificate is required even if the SSLEngine is not turned on for this virtual host. Is there a way to get around the problem besides providing a cert? No - when your browser has https in the URL, it expects to talk SSL. it doesn't, it'll fail. Apache is being nice by telling you this, otherwise you'd have some obscure browser errors ...


5

So when you generated your CSR you would have specified a CN (Common Name) that corresponds to the specific hostname that you want to use the certificate for.1 Where ever this hostname lives is where you want to install the certificate. For the sake of sane examples let's use www.example.com as the hostname for your certificate. When you generated the CSR ...


5

In your config, you have these three lines: SSLCertificateFile /etc/ssl/certs/mycert.crt SSLCertificateKeyFile /etc/ssl/private/mycert.key SSLCertificateFile /etc/ssl/certs/sub.class1.server.ca.pem You are repeating SSLCertificateFile. That means that Apache will use the second instance of the variable, i.e. /etc/ssl/certs/sub.class1.server.ca.pem - but ...


5

Your first virtualhost (for the www.domain.tld) does not have SSL enabled, even though it's on port 443. You need to add SSLEngine, SSLCertificateFile, ... as in the second one, otherwise no https access will be possible for www.domain.tld. I'm not too sure it should cause a flat refusal to start, however...


5

Delete that line from your modules list. SSL support is compiled into lighttpd and is not a separate module. If your version has this support compiled in the output of lighttpd -v will include (ssl). [root@APPS /]# lighttpd -v lighttpd/1.4.36 (ssl) - a light and fast webserver Build-Date: Jul 27 2015 14:27:26 [root@APPS /]# The actual work is done by the ...


Only top voted, non community-wiki answers of a minimum length are eligible