github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/ssl/ssl_faq.html.en (about) 1 <?xml version="1.0" encoding="ISO-8859-1"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> 5 <!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10 <title>SSL/TLS Strong Encryption: FAQ - Apache HTTP Server Version 2.2</title> 11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> 14 <script src="../style/scripts/prettify.min.js" type="text/javascript"> 15 </script> 16 17 <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/ssl/ssl_faq.html" rel="canonical" /></head> 18 <body id="manual-page"><div id="page-header"> 19 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p> 20 <p class="apache">Apache HTTP Server Version 2.2</p> 21 <img alt="" src="../images/feather.gif" /></div> 22 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div> 23 <div id="path"> 24 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.2</a> > <a href="./">SSL/TLS</a></div><div id="page-content"><div class="retired"><h4>Please note</h4> 25 <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> 26 <p>You may follow <a href="http://httpd.apache.org/docs/current/ssl/ssl_faq.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>SSL/TLS Strong Encryption: FAQ</h1> 27 <div class="toplang"> 28 <p><span>Available Languages: </span><a href="../en/ssl/ssl_faq.html" title="English"> en </a></p> 29 </div> 30 31 <blockquote> 32 <p>The wise man doesn't give the right answers, 33 he poses the right questions.</p> 34 <p class="cite">-- <cite>Claude Levi-Strauss</cite></p> 35 36 </blockquote> 37 <p>This chapter is a collection of frequently asked questions (FAQ) and 38 corresponding answers following the popular USENET tradition. Most of these 39 questions occurred on the Newsgroup <code><a href="news:comp.infosystems.www.servers.unix">comp.infosystems.www.servers.unix</a></code> or the mod_ssl Support 40 Mailing List <code><a href="mailto:modssl-users@modssl.org">modssl-users@modssl.org</a></code>. They are collected at this place 41 to avoid answering the same questions over and over.</p> 42 43 <p>Please read this chapter at least once when installing mod_ssl or at least 44 search for your problem here before submitting a problem report to the 45 author.</p> 46 </div> 47 <div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#about">About The Module</a></li> 48 <li><img alt="" src="../images/down.gif" /> <a href="#installation">Installation</a></li> 49 <li><img alt="" src="../images/down.gif" /> <a href="#aboutconfig">Configuration</a></li> 50 <li><img alt="" src="../images/down.gif" /> <a href="#aboutcerts">Certificates</a></li> 51 <li><img alt="" src="../images/down.gif" /> <a href="#aboutssl">The SSL Protocol</a></li> 52 <li><img alt="" src="../images/down.gif" /> <a href="#support">mod_ssl Support</a></li> 53 </ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 54 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 55 <div class="section"> 56 <h2><a name="about" id="about">About The Module</a></h2> 57 <ul> 58 <li><a href="#history">What is the history of mod_ssl?</a></li> 59 <li><a href="#wassenaar">mod_ssl and Wassenaar Arrangement?</a></li> 60 </ul> 61 62 <h3><a name="history" id="history">What is the history of mod_ssl?</a></h3> 63 <p>The mod_ssl v1 package was initially created in April 1998 by <a href="mailto:rse@engelschall.com">Ralf S. Engelschall</a> via porting <a href="mailto:ben@algroup.co.uk">Ben Laurie</a>'s <a href="http://www.apache-ssl.org/">Apache-SSL</a> 1.17 source patches for 64 Apache 1.2.6 to Apache 1.3b6. Because of conflicts with Ben 65 Laurie's development cycle it then was re-assembled from scratch for 66 Apache 1.3.0 by merging the old mod_ssl 1.x with the newer Apache-SSL 67 1.18. From this point on mod_ssl lived its own life as mod_ssl v2. The 68 first publicly released version was mod_ssl 2.0.0 from August 10th, 69 1998. </p> 70 71 <p>After US export restrictions on cryptographic software were 72 loosened, <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> became part of the Apache HTTP 73 Server with the release of Apache httpd 2.</p> 74 75 76 <h3><a name="wassenaar" id="wassenaar">Is mod_ssl affected by the Wassenaar Arrangement?</a></h3> 77 <p>First, let us explain what <dfn>Wassenaar</dfn> and its <dfn>Arrangement on 78 Export Controls for Conventional Arms and Dual-Use Goods and 79 Technologies</dfn> is: This is a international regime, established in 1995, to 80 control trade in conventional arms and dual-use goods and technology. It 81 replaced the previous <dfn>CoCom</dfn> regime. Further details on 82 both the Arrangement and its signatories are available at <a href="http://www.wassenaar.org/">http://www.wassenaar.org/</a>.</p> 83 84 <p>In short, the aim of the Wassenaar Arrangement is to prevent the build up 85 of military capabilities that threaten regional and international security 86 and stability. The Wassenaar Arrangement controls the export of 87 cryptography as a dual-use good, that is, something that has both military and 88 civilian applications. However, the Wassenaar Arrangement also provides an 89 exemption from export controls for mass-market software and free software.</p> 90 91 <p>In the current Wassenaar <cite>List of Dual Use Goods and Technologies And 92 Munitions</cite>, under <q>GENERAL SOFTWARE NOTE (GSN)</q> it says 93 <q>The Lists do not control "software" which is either: 1. [...] 2. "in 94 the public domain".</q> And under <q>DEFINITIONS OF TERMS USED IN 95 THESE LISTS</q> we find <q>In the public 96 domain</q> defined as <q>"technology" or "software" which has been made 97 available without restrictions upon its further dissemination. Note: 98 Copyright restrictions do not remove "technology" or "software" from being 99 "in the public domain".</q></p> 100 101 <p>So, both mod_ssl and OpenSSL are <q>in the public domain</q> for the purposes 102 of the Wassenaar Arrangement and its <q>List of Dual Use Goods and 103 Technologies And Munitions List</q>, and thus not affected by its provisions.</p> 104 105 106 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 107 <div class="section"> 108 <h2><a name="installation" id="installation">Installation</a></h2> 109 <ul> 110 <li><a href="#mutex">Why do I get permission errors related to 111 SSLMutex when I start Apache?</a></li> 112 <li><a href="#entropy">Why does mod_ssl stop with the error "Failed to 113 generate temporary 512 bit RSA private key" when I start Apache?</a></li> 114 </ul> 115 116 <h3><a name="mutex" id="mutex">Why do I get permission errors related to 117 SSLMutex when I start Apache?</a></h3> 118 <p>Errors such as ``<code>mod_ssl: Child could not open 119 SSLMutex lockfile /opt/apache/logs/ssl_mutex.18332 (System error follows) 120 [...] System: Permission denied (errno: 13)</code>'' are usually 121 caused by overly restrictive permissions on the <em>parent</em> directories. 122 Make sure that all parent directories (here <code>/opt</code>, 123 <code>/opt/apache</code> and <code>/opt/apache/logs</code>) have the x-bit 124 set for, at minimum, the UID under which Apache's children are running (see 125 the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> directive).</p> 126 127 128 <h3><a name="entropy" id="entropy">Why does mod_ssl stop with the error 129 "Failed to generate temporary 512 bit RSA private key" when I start 130 Apache?</a></h3> 131 <p>Cryptographic software needs a source of unpredictable data 132 to work correctly. Many open source operating systems provide 133 a "randomness device" that serves this purpose (usually named 134 <code>/dev/random</code>). On other systems, applications have to 135 seed the OpenSSL Pseudo Random Number Generator (PRNG) manually with 136 appropriate data before generating keys or performing public key 137 encryption. As of version 0.9.5, the OpenSSL functions that need 138 randomness report an error if the PRNG has not been seeded with 139 at least 128 bits of randomness.</p> 140 <p>To prevent this error, <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> has to provide 141 enough entropy to the PRNG to allow it to work correctly. This can 142 be done via the <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code> 143 directive.</p> 144 145 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 146 <div class="section"> 147 <h2><a name="aboutconfig" id="aboutconfig">Configuration</a></h2> 148 <ul> 149 <li><a href="#parallel">Is it possible to provide HTTP and HTTPS from 150 the same server?</a></li> 151 <li><a href="#ports">Which port does HTTPS use?</a></li> 152 <li><a href="#httpstest">How do I speak HTTPS manually for testing 153 purposes?</a></li> 154 <li><a href="#hang">Why does the connection hang when I connect to my 155 SSL-aware Apache server?</a></li> 156 <li><a href="#refused">Why do I get ``Connection Refused'' errors, when 157 trying to access my newly installed Apache+mod_ssl server via HTTPS?</a></li> 158 <li><a href="#envvars">Why are the <code>SSL_XXX</code> variables not 159 available to my CGI & SSI scripts?</a></li> 160 <li><a href="#relative">How can I switch between HTTP and HTTPS in 161 relative hyperlinks?</a></li> 162 </ul> 163 164 <h3><a name="parallel" id="parallel">Is it possible to provide HTTP and HTTPS 165 from the same server?</a></h3> 166 <p>Yes. HTTP and HTTPS use different server ports (HTTP binds to 167 port 80, HTTPS to port 443), so there is no direct conflict between 168 them. You can either run two separate server instances bound to 169 these ports, or use Apache's elegant virtual hosting facility to 170 create two virtual servers, both served by the same instance of Apache 171 - one responding over HTTP to requests on port 80, and the other 172 responding over HTTPS to requests on port 443.</p> 173 174 175 <h3><a name="ports" id="ports">Which port does HTTPS use?</a></h3> 176 <p>You can run HTTPS on any port, but the standards specify port 443, which 177 is where any HTTPS compliant browser will look by default. You can force 178 your browser to look on a different port by specifying it in the URL. For 179 example, if your server is set up to serve pages over HTTPS on port 8080, 180 you can access them at <code>https://example.com:8080/</code></p> 181 182 183 <h3><a name="httpstest" id="httpstest">How do I speak HTTPS manually for testing purposes?</a></h3> 184 <p>While you usually just use</p> 185 186 <div class="example"><p><code>$ telnet localhost 80<br /> 187 GET / HTTP/1.0</code></p></div> 188 189 <p>for simple testing of Apache via HTTP, it's not so easy for 190 HTTPS because of the SSL protocol between TCP and HTTP. With the 191 help of OpenSSL's <code>s_client</code> command, however, you can 192 do a similar check via HTTPS:</p> 193 194 <div class="example"><p><code>$ openssl s_client -connect localhost:443 -state -debug<br /> 195 GET / HTTP/1.0</code></p></div> 196 197 <p>Before the actual HTTP response you will receive detailed 198 information about the SSL handshake. For a more general command 199 line client which directly understands both HTTP and HTTPS, can 200 perform GET and POST operations, can use a proxy, supports byte 201 ranges, etc. you should have a look at the nifty 202 <a href="http://curl.haxx.se/">cURL</a> tool. Using this, you can 203 check that Apache is responding correctly to requests via HTTP and 204 HTTPS as follows:</p> 205 206 <div class="example"><p><code>$ curl http://localhost/<br /> 207 $ curl https://localhost/</code></p></div> 208 209 210 <h3><a name="hang" id="hang">Why does the connection hang when I connect 211 to my SSL-aware Apache server?</a></h3> 212 213 <p>This can happen when you try to connect to a HTTPS server (or virtual 214 server) via HTTP (eg, using <code>http://example.com/</code> instead of 215 <code>https://example.com</code>). It can also happen when trying to 216 connect via HTTPS to a HTTP server (eg, using 217 <code>https://example.com/</code> on a server which doesn't support HTTPS, 218 or which supports it on a non-standard port). Make sure that you're 219 connecting to a (virtual) server that supports SSL.</p> 220 221 <h3><a name="refused" id="refused">Why do I get ``Connection Refused'' messages, 222 when trying to access my newly installed Apache+mod_ssl server via HTTPS?</a></h3> 223 <p> 224 This error can be caused by an incorrect configuration. 225 Please make sure that your <code class="directive"><a href="../mod/mpm_common.html#listen">Listen</a></code> directives match your 226 <code class="directive"><a href="../mod/core.html#virtualhost"><VirtualHost></a></code> 227 directives. If all else fails, please start afresh, using the default 228 configuration provided by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>.</p> 229 230 231 <h3><a name="envvars" id="envvars">Why are the <code>SSL_XXX</code> variables 232 not available to my CGI & SSI scripts?</a></h3> 233 <p>Please make sure you have ``<code>SSLOptions +StdEnvVars</code>'' 234 enabled for the context of your CGI/SSI requests.</p> 235 236 237 <h3><a name="relative" id="relative">How can I switch between HTTP and HTTPS in relative 238 hyperlinks?</a></h3> 239 240 <p>Usually, to switch between HTTP and HTTPS, you have to use 241 fully-qualified hyperlinks (because you have to change the URL 242 scheme). Using <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> however, you can 243 manipulate relative hyperlinks, to achieve the same effect.</p> 244 <div class="example"><p><code> 245 RewriteEngine on<br /> 246 RewriteRule ^/(.*)_SSL$ https://%{SERVER_NAME}/$1 [R,L]<br /> 247 RewriteRule ^/(.*)_NOSSL$ http://%{SERVER_NAME}/$1 [R,L] 248 </code></p></div> 249 250 <p>This rewrite ruleset lets you use hyperlinks of the form 251 <code><a href="document.html_SSL"></code>, to switch to HTTPS 252 in a relative link. (Replace SSL with NOSSL to switch to HTTP.)</p> 253 254 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 255 <div class="section"> 256 <h2><a name="aboutcerts" id="aboutcerts">Certificates</a></h2> 257 <ul> 258 <li><a href="#keyscerts">What are RSA Private Keys, CSRs and 259 Certificates?</a></li> 260 <li><a href="#startup">Is there a difference on startup between 261 a non-SSL-aware Apache and an SSL-aware Apache?</a></li> 262 <li><a href="#selfcert">How do I create a self-signed SSL 263 Certificate for testing purposes?</a></li> 264 <li><a href="#realcert">How do I create a real SSL Certificate?</a></li> 265 <li><a href="#ownca">How do I create and use my own Certificate 266 Authority (CA)?</a></li> 267 <li><a href="#passphrase">How can I change the pass-phrase on my private 268 key file?</a></li> 269 <li><a href="#removepassphrase">How can I get rid of the pass-phrase 270 dialog at Apache startup time?</a></li> 271 <li><a href="#verify">How do I verify that a private key matches its 272 Certificate?</a></li> 273 <li><a href="#badcert">Why do connections fail with an "alert bad 274 certificate" error?</a></li> 275 <li><a href="#keysize">Why does my 2048-bit private key not work?</a></li> 276 <li><a href="#hashsymlinks">Why is client authentication broken after 277 upgrading from SSLeay version 0.8 to 0.9?</a></li> 278 <li><a href="#pemder">How can I convert a certificate from PEM to DER 279 format?</a></li> 280 <li><a href="#verisign">Why can't I find the 281 <code>getca</code> or <code>getverisign</code> programs mentioned by 282 Verisign, for installing my Verisign certificate?</a></li> 283 <li><a href="#sgc">Can I use the Server Gated Cryptography (SGC) 284 facility (aka Verisign Global ID) with mod_ssl?</a></li> 285 <li><a href="#gid">Why do browsers complain that they cannot 286 verify my server certificate?</a></li> 287 </ul> 288 289 <h3><a name="keyscerts" id="keyscerts">What are RSA Private Keys, CSRs and Certificates?</a></h3> 290 <p>An RSA private key file is a digital file that you can use to decrypt 291 messages sent to you. It has a public component which you distribute (via 292 your Certificate file) which allows people to encrypt those messages to 293 you.</p> 294 <p>A Certificate Signing Request (CSR) is a digital file which contains 295 your public key and your name. You send the CSR to a Certifying Authority 296 (CA), who will convert it into a real Certificate, by signing it.</p> 297 <p>A Certificate contains your 298 RSA public key, your name, the name of the CA, and is digitally signed by 299 the CA. Browsers that know the CA can verify the signature on that 300 Certificate, thereby obtaining your RSA public key. That enables them to 301 send messages which only you can decrypt.</p> 302 <p>See the <a href="ssl_intro.html">Introduction</a> chapter for a general 303 description of the SSL protocol.</p> 304 305 306 <h3><a name="startup" id="startup">Is there a difference on startup between 307 a non-SSL-aware Apache and an SSL-aware Apache?</a></h3> 308 <p>Yes. In general, starting Apache with 309 <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> built-in is just like starting Apache 310 without it. However, if you have a passphrase on your SSL private 311 key file, a startup dialog will pop up which asks you to enter the 312 pass phrase.</p> 313 314 <p>Having to manually enter the passphrase when starting the server 315 can be problematic - for example, when starting the server from the 316 system boot scripts. In this case, you can follow the steps 317 <a href="#removepassphrase">below</a> to remove the passphrase from 318 your private key. Bear in mind that doing so brings additional security 319 risks - proceed with caution!</p> 320 321 322 <h3><a name="selfcert" id="selfcert">How do I create a self-signed SSL 323 Certificate for testing purposes?</a></h3> 324 <ol> 325 <li>Make sure OpenSSL is installed and in your <code>PATH</code>.<br /> 326 <br /> 327 </li> 328 <li>Run the following command, to create <code>server.key</code> and 329 <code>server.crt</code> files:<br /> 330 <code><strong>$ openssl req -new -x509 -nodes -out server.crt 331 -keyout server.key</strong></code><br /> 332 These can be used as follows in your <code>httpd.conf</code> 333 file: 334 <pre> SSLCertificateFile /path/to/this/server.crt 335 SSLCertificateKeyFile /path/to/this/server.key</pre> 336 </li> 337 <li>It is important that you are aware that this 338 <code>server.key</code> does <em>not</em> have any passphrase. 339 To add a passphrase to the key, you should run the following 340 command, and enter & verify the passphrase as requested.<br /> 341 <p><code><strong>$ openssl rsa -des3 -in server.key -out 342 server.key.new</strong></code><br /> 343 <code><strong>$ mv server.key.new server.key</strong></code><br /></p> 344 Please backup the <code>server.key</code> file, and the passphrase 345 you entered, in a secure location. 346 </li> 347 </ol> 348 349 350 <h3><a name="realcert" id="realcert">How do I create a real SSL Certificate?</a></h3> 351 <p>Here is a step-by-step description:</p> 352 <ol> 353 <li>Make sure OpenSSL is installed and in your <code>PATH</code>. 354 <br /> 355 <br /> 356 </li> 357 <li>Create a RSA private key for your Apache server 358 (will be Triple-DES encrypted and PEM formatted):<br /> 359 <br /> 360 <code><strong>$ openssl genrsa -des3 -out server.key 1024</strong></code><br /> 361 <br /> 362 Please backup this <code>server.key</code> file and the 363 pass-phrase you entered in a secure location. 364 You can see the details of this RSA private key by using the command:<br /> 365 366 <br /> 367 <code><strong>$ openssl rsa -noout -text -in server.key</strong></code><br /> 368 <br /> 369 If necessary, you can also create a decrypted PEM version (not 370 recommended) of this RSA private key with:<br /> 371 <br /> 372 <code><strong>$ openssl rsa -in server.key -out server.key.unsecure</strong></code><br /> 373 <br /> 374 375 </li> 376 <li>Create a Certificate Signing Request (CSR) with the server RSA private 377 key (output will be PEM formatted):<br /> 378 <br /> 379 <code><strong>$ openssl req -new -key server.key -out server.csr</strong></code><br /> 380 <br /> 381 Make sure you enter the FQDN ("Fully Qualified Domain Name") of the 382 server when OpenSSL prompts you for the "CommonName", i.e. when you 383 generate a CSR for a website which will be later accessed via 384 <code>https://www.foo.dom/</code>, enter "www.foo.dom" here. 385 You can see the details of this CSR by using<br /> 386 387 <br /> 388 <code><strong>$ openssl req -noout -text -in server.csr</strong></code><br /> 389 <br /> 390 </li> 391 <li>You now have to send this Certificate Signing Request (CSR) to 392 a Certifying Authority (CA) to be signed. Once the CSR has been 393 signed, you will have a real Certificate, which can be used by 394 Apache. You can have a CSR signed by a commercial CA, or you can 395 create your own CA to sign it.<br /> 396 Commercial CAs usually ask you to post the CSR into a web form, 397 pay for the signing, and then send a signed Certificate, which 398 you can store in a server.crt file. For more information about 399 commercial CAs see the following locations:<br /> 400 <br /> 401 <ol> 402 <li> Verisign<br /> 403 <a href="http://digitalid.verisign.com/server/apacheNotice.htm"> 404 http://digitalid.verisign.com/server/apacheNotice.htm 405 </a> 406 </li> 407 <li> Thawte<br /> 408 <a href="http://www.thawte.com/">http://www.thawte.com/</a> 409 </li> 410 <li> CertiSign Certificadora Digital Ltda.<br /> 411 <a href="http://www.certisign.com.br"> 412 http://www.certisign.com.br 413 </a> 414 </li> 415 <li> IKS GmbH<br /> 416 <a href="http://www.iks-jena.de/leistungen/ca/"> 417 http://www.iks-jena.de/leistungen/ca/ 418 </a> 419 </li> 420 <li> Uptime Commerce Ltd.<br /> 421 <a href="http://www.uptimecommerce.com"> 422 http://www.uptimecommerce.com 423 </a> 424 </li> 425 <li> BelSign NV/SA<br /> 426 <a href="http://www.belsign.be"> 427 http://www.belsign.be 428 </a> 429 </li> 430 </ol> 431 432 For details on how to create your own CA, and use this to sign 433 a CSR, see <a href="#ownca">below</a>.<br /> 434 435 Once your CSR has been signed, you can see the details of the 436 Certificate as follows:<br /> 437 <br /> 438 <code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br /> 439 440 </li> 441 <li>You should now have two files: <code>server.key</code> and 442 <code>server.crt</code>. These can be used as follows in your 443 <code>httpd.conf</code> file: 444 <pre> SSLCertificateFile /path/to/this/server.crt 445 SSLCertificateKeyFile /path/to/this/server.key</pre> 446 The <code>server.csr</code> file is no longer needed. 447 </li> 448 449 </ol> 450 451 452 <h3><a name="ownca" id="ownca">How do I create and use my own Certificate Authority (CA)?</a></h3> 453 <p>The short answer is to use the <code>CA.sh</code> or <code>CA.pl</code> 454 script provided by OpenSSL. Unless you have a good reason not to, 455 you should use these for preference. If you cannot, you can create a 456 self-signed Certificate as follows:</p> 457 458 <ol> 459 <li>Create a RSA private key for your server 460 (will be Triple-DES encrypted and PEM formatted):<br /> 461 <br /> 462 <code><strong>$ openssl genrsa -des3 -out server.key 1024</strong></code><br /> 463 <br /> 464 Please backup this <code>server.key</code> file and the 465 pass-phrase you entered in a secure location. 466 You can see the details of this RSA private key by using the 467 command:<br /> 468 <br /> 469 <code><strong>$ openssl rsa -noout -text -in server.key</strong></code><br /> 470 <br /> 471 If necessary, you can also create a decrypted PEM version (not 472 recommended) of this RSA private key with:<br /> 473 <br /> 474 <code><strong>$ openssl rsa -in server.key -out server.key.unsecure</strong></code><br /> 475 <br /> 476 </li> 477 <li>Create a self-signed Certificate (X509 structure) 478 with the RSA key you just created (output will be PEM formatted):<br /> 479 <br /> 480 <code><strong>$ openssl req -new -x509 -nodes -sha1 -days 365 481 -key server.key -out server.crt</strong></code><br /> 482 <br /> 483 This signs the server CSR and results in a <code>server.crt</code> file.<br /> 484 You can see the details of this Certificate using:<br /> 485 <br /> 486 <code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br /> 487 <br /> 488 </li> 489 </ol> 490 491 492 <h3><a name="passphrase" id="passphrase">How can I change the pass-phrase on my private key file?</a></h3> 493 <p>You simply have to read it with the old pass-phrase and write it again, 494 specifying the new pass-phrase. You can accomplish this with the following 495 commands:</p> 496 497 498 <p><code><strong>$ openssl rsa -des3 -in server.key -out server.key.new</strong></code><br /> 499 <code><strong>$ mv server.key.new server.key</strong></code><br /></p> 500 501 <p>The first time you're asked for a PEM pass-phrase, you should 502 enter the old pass-phrase. After that, you'll be asked again to 503 enter a pass-phrase - this time, use the new pass-phrase. If you 504 are asked to verify the pass-phrase, you'll need to enter the new 505 pass-phrase a second time.</p> 506 507 508 <h3><a name="removepassphrase" id="removepassphrase">How can I get rid of the pass-phrase dialog at Apache startup time?</a></h3> 509 <p>The reason this dialog pops up at startup and every re-start 510 is that the RSA private key inside your server.key file is stored in 511 encrypted format for security reasons. The pass-phrase is needed to decrypt 512 this file, so it can be read and parsed. Removing the pass-phrase 513 removes a layer of security from your server - proceed with caution!</p> 514 <ol> 515 <li>Remove the encryption from the RSA private key (while 516 keeping a backup copy of the original file):<br /> 517 <br /> 518 <code><strong>$ cp server.key server.key.org</strong></code><br /> 519 <code><strong>$ openssl rsa -in server.key.org -out server.key</strong></code><br /> 520 521 <br /> 522 </li> 523 <li>Make sure the server.key file is only readable by root:<br /> 524 <br /> 525 <code><strong>$ chmod 400 server.key</strong></code><br /> 526 <br /> 527 </li> 528 </ol> 529 530 <p>Now <code>server.key</code> contains an unencrypted copy of the key. 531 If you point your server at this file, it will not prompt you for a 532 pass-phrase. HOWEVER, if anyone gets this key they will be able to 533 impersonate you on the net. PLEASE make sure that the permissions on this 534 file are such that only root or the web server user can read it 535 (preferably get your web server to start as root but run as another 536 user, and have the key readable only by root).</p> 537 538 <p>As an alternative approach you can use the ``<code>SSLPassPhraseDialog 539 exec:/path/to/program</code>'' facility. Bear in mind that this is 540 neither more nor less secure, of course.</p> 541 542 543 <h3><a name="verify" id="verify">How do I verify that a private key matches its Certificate?</a></h3> 544 <p>A private key contains a series of numbers. Two of these numbers form 545 the "public key", the others are part of the "private key". The "public 546 key" bits are included when you generate a CSR, and subsequently form 547 part of the associated Certificate.</p> 548 <p>To check that the public key in your Certificate matches the public 549 portion of your private key, you simply need to compare these numbers. 550 To view the Certificate and the key run the commands:</p> 551 552 <p><code><strong>$ openssl x509 -noout -text -in server.crt</strong></code><br /> 553 <code><strong>$ openssl rsa -noout -text -in server.key</strong></code></p> 554 555 <p>The `modulus' and the `public exponent' portions in the key and the 556 Certificate must match. As the public exponent is usually 65537 557 and it's difficult to visually check that the long modulus numbers 558 are the same, you can use the following approach:</p> 559 560 <p><code><strong>$ openssl x509 -noout -modulus -in server.crt | openssl md5</strong></code><br /> 561 <code><strong>$ openssl rsa -noout -modulus -in server.key | openssl md5</strong></code></p> 562 563 <p>This leaves you with two rather shorter numbers to compare. It is, 564 in theory, possible that these numbers may be the same, without the 565 modulus numbers being the same, but the chances of this are 566 overwhelmingly remote.</p> 567 <p>Should you wish to check to which key or certificate a particular 568 CSR belongs you can perform the same calculation on the CSR as 569 follows:</p> 570 571 <p><code><strong>$ openssl req -noout -modulus -in server.csr | openssl md5</strong></code></p> 572 573 574 <h3><a name="badcert" id="badcert">Why do connections fail with an "alert 575 bad certificate" error?</a></h3> 576 <p>Errors such as <code>OpenSSL: error:14094412: SSL 577 routines:SSL3_READ_BYTES:sslv3 alert bad certificate</code> in the SSL 578 logfile, are usually caused by a browser which is unable to handle the server 579 certificate/private-key. For example, Netscape Navigator 3.x is 580 unable to handle RSA key lengths not equal to 1024 bits.</p> 581 582 583 <h3><a name="keysize" id="keysize">Why does my 2048-bit private key not work?</a></h3> 584 <p>The private key sizes for SSL must be either 512 or 1024 bits, for compatibility 585 with certain web browsers. A keysize of 1024 bits is recommended because 586 keys larger than 1024 bits are incompatible with some versions of Netscape 587 Navigator and Microsoft Internet Explorer, and with other browsers that 588 use RSA's BSAFE cryptography toolkit.</p> 589 590 591 <h3><a name="hashsymlinks" id="hashsymlinks">Why is client authentication broken after upgrading from 592 SSLeay version 0.8 to 0.9?</a></h3> 593 <p>The CA certificates under the path you configured with 594 <code>SSLCACertificatePath</code> are found by SSLeay through hash 595 symlinks. These hash values are generated by the `<code>openssl x509 -noout 596 -hash</code>' command. However, the algorithm used to calculate the hash for a 597 certificate changed between SSLeay 0.8 and 0.9. You will need to remove 598 all old hash symlinks and create new ones after upgrading. Use the 599 <code>Makefile</code> provided by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>.</p> 600 601 602 <h3><a name="pemder" id="pemder">How can I convert a certificate from PEM to DER format?</a></h3> 603 <p>The default certificate format for SSLeay/OpenSSL is PEM, which is simply 604 Base64 encoded DER, with header and footer lines. For some applications 605 (e.g. Microsoft Internet Explorer) you need the certificate in plain DER 606 format. You can convert a PEM file <code>cert.pem</code> into the 607 corresponding DER file <code>cert.der</code> using the following command: 608 <code><strong>$ openssl x509 -in cert.pem -out cert.der -outform DER</strong></code></p> 609 610 611 <h3><a name="verisign" id="verisign">Why can't I find the 612 <code>getca</code> or <code>getverisign</code> programs mentioned by 613 Verisign, for installing my Verisign certificate?</a></h3> 614 <p>Verisign has never provided specific instructions 615 for Apache+mod_ssl. The instructions provided are for C2Net's 616 Stronghold (a commercial Apache based server with SSL support).</p> 617 <p>To install your certificate, all you need to do is to save the 618 certificate to a file, and give the name of that file to the 619 <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatefile">SSLCertificateFile</a></code> directive. 620 You will also need to give it the key file. For more information, 621 see the <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatekeyfile">SSLCertificateKeyFile</a></code> 622 directive.</p> 623 624 625 <h3><a name="sgc" id="sgc">Can I use the Server Gated Cryptography (SGC) 626 facility (aka Verisign Global ID) with mod_ssl?</a></h3> 627 <p>Yes. <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> has included support for the SGC 628 facility since version 2.1. No special configuration is required - 629 just use the Global ID as your server certificate. The 630 <em>step up</em> of the clients is then automatically handled by 631 <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> at run-time.</p> 632 633 634 <h3><a name="gid" id="gid">Why do browsers complain that they cannot 635 verify my server certificate?</a></h3> 636 <p>One reason this might happen is because your server certificate is signed 637 by an intermediate CA. Various CAs, such as Verisign or Thawte, have started 638 signing certificates not with their root certificate but with intermediate 639 certificates.</p> 640 641 <p>Intermediate CA certificates lie between the root CA certificate (which is 642 installed in the browsers) and the server certificate (which you installed 643 on the server). In order for the browser to be able to traverse and verify 644 the trust chain from the server certificate to the root certificate it 645 needs need to be given the intermediate certificates. The CAs should 646 be able to provide you such intermediate certificate packages that can be 647 installed on the server.</p> 648 649 <p>You need to include those intermediate certificates with the 650 <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatechainfile">SSLCertificateChainFile</a></code> 651 directive.</p> 652 653 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 654 <div class="section"> 655 <h2><a name="aboutssl" id="aboutssl">The SSL Protocol</a></h2> 656 <ul> 657 <li><a href="#random">Why do I get lots of random SSL protocol 658 errors under heavy server load?</a></li> 659 <li><a href="#load">Why does my webserver have a higher load, now 660 that it serves SSL encrypted traffic?</a></li> 661 <li><a href="#establishing">Why do HTTPS connections to my server 662 sometimes take up to 30 seconds to establish a connection?</a></li> 663 <li><a href="#ciphers">What SSL Ciphers are supported by mod_ssl?</a></li> 664 <li><a href="#adh">Why do I get ``no shared cipher'' errors, when 665 trying to use Anonymous Diffie-Hellman (ADH) ciphers?</a></li> 666 <li><a href="#sharedciphers">Why do I get a 'no shared ciphers' 667 error when connecting to my newly installed server?</a></li> 668 <li><a href="#vhosts">Why can't I use SSL with name-based/non-IP-based 669 virtual hosts?</a></li> 670 <li><a href="#vhosts2">Is it possible to use Name-Based Virtual 671 Hosting to identify different SSL virtual hosts?</a></li> 672 <li><a href="#comp">How do I get SSL compression working?</a></li> 673 <li><a href="#lockicon">When I use Basic Authentication over HTTPS 674 the lock icon in Netscape browsers stays unlocked when the dialog pops up. 675 Does this mean the username/password is being sent unencrypted?</a></li> 676 <li><a href="#msie">Why do I get I/O errors when connecting via 677 HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer 678 (MSIE)?</a></li> 679 <li><a href="#nn">Why do I get I/O errors, or the message "Netscape has 680 encountered bad data from the server", when connecting via 681 HTTPS to an Apache+mod_ssl server with Netscape Navigator?</a></li> 682 <li><a href="#javadh">Why do I get handshake failures with Java-based clients when using a certificate with more than 1024 bits?</a></li> 683 </ul> 684 685 <h3><a name="random" id="random">Why do I get lots of random SSL protocol 686 errors under heavy server load?</a></h3> 687 <p>There can be a number of reasons for this, but the main one 688 is problems with the SSL session Cache specified by the 689 <code class="directive"><a href="../mod/mod_ssl.html#sslsessioncache">SSLSessionCache</a></code> directive. The DBM session 690 cache is the most likely source of the problem, so using the SHM session cache (or 691 no cache at all) may help.</p> 692 693 694 <h3><a name="load" id="load">Why does my webserver have a higher load, now 695 that it serves SSL encrypted traffic?</a></h3> 696 <p>SSL uses strong cryptographic encryption, which necessitates a lot of 697 number crunching. When you request a webpage via HTTPS, everything (even 698 the images) is encrypted before it is transferred. So increased HTTPS 699 traffic leads to load increases.</p> 700 701 702 <h3><a name="establishing" id="establishing">Why do HTTPS connections to my server 703 sometimes take up to 30 seconds to establish a connection?</a></h3> 704 <p>This is usually caused by a <code>/dev/random</code> device for 705 <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code> which blocks the 706 read(2) call until enough entropy is available to service the 707 request. More information is available in the reference 708 manual for the <code class="directive"><a href="../mod/mod_ssl.html#sslrandomseed">SSLRandomSeed</a></code> 709 directive.</p> 710 711 712 <h3><a name="ciphers" id="ciphers">What SSL Ciphers are supported by mod_ssl?</a></h3> 713 <p>Usually, any SSL ciphers supported by the version of OpenSSL in use, 714 are also supported by <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code>. Which ciphers are 715 available can depend on the way you built OpenSSL. Typically, at 716 least the following ciphers are supported:</p> 717 718 <ol> 719 <li>RC4 with MD5</li> 720 <li>RC4 with MD5 (export version restricted to 40-bit key)</li> 721 <li>RC2 with MD5</li> 722 <li>RC2 with MD5 (export version restricted to 40-bit key)</li> 723 <li>IDEA with MD5</li> 724 <li>DES with MD5</li> 725 <li>Triple-DES with MD5</li> 726 </ol> 727 728 <p>To determine the actual list of ciphers available, you should run 729 the following:</p> 730 <div class="example"><p><code>$ openssl ciphers -v</code></p></div> 731 732 733 <h3><a name="adh" id="adh">Why do I get ``no shared cipher'' errors, when 734 trying to use Anonymous Diffie-Hellman (ADH) ciphers?</a></h3> 735 <p>By default, OpenSSL does <em>not</em> allow ADH ciphers, for security 736 reasons. Please be sure you are aware of the potential side-effects 737 if you choose to enable these ciphers.</p> 738 <p>In order to use Anonymous Diffie-Hellman (ADH) ciphers, you must 739 build OpenSSL with ``<code>-DSSL_ALLOW_ADH</code>'', and then add 740 ``<code>ADH</code>'' into your <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code>.</p> 741 742 743 <h3><a name="sharedciphers" id="sharedciphers">Why do I get a 'no shared ciphers' 744 error when connecting to my newly installed server?</a></h3> 745 <p>Either you have made a mistake with your 746 <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code> 747 directive (compare it with the pre-configured example in 748 <code>httpd.conf-dist</code>) or you chose to use DSA/DH 749 algorithms instead of RSA when you generated your private key 750 and ignored or overlooked the warnings. If you have chosen 751 DSA/DH, then your server cannot communicate using RSA-based SSL 752 ciphers (at least until you configure an additional RSA-based 753 certificate/key pair). Modern browsers like NS or IE can only 754 communicate over SSL using RSA ciphers. The result is the 755 "no shared ciphers" error. To fix this, regenerate your server 756 certificate/key pair, using the RSA algorithm.</p> 757 758 759 <h3><a name="vhosts" id="vhosts">Why can't I use SSL with name-based/non-IP-based virtual hosts?</a></h3> 760 <p>The reason is very technical, and a somewhat "chicken and egg" problem. 761 The SSL protocol layer stays below the HTTP protocol layer and 762 encapsulates HTTP. When an SSL connection (HTTPS) is established 763 Apache/mod_ssl has to negotiate the SSL protocol parameters with the 764 client. For this, mod_ssl has to consult the configuration of the virtual 765 server (for instance it has to look for the cipher suite, the server 766 certificate, etc.). But in order to go to the correct virtual server 767 Apache has to know the <code>Host</code> HTTP header field. To do this, the 768 HTTP request header has to be read. This cannot be done before the SSL 769 handshake is finished, but the information is needed in order to 770 complete the SSL handshake phase. See the next question for how to 771 circumvent this issue.</p> 772 773 <p>Note that if you have a wildcard SSL certificate, or a 774 certificate that has multiple hostnames on it using subjectAltName 775 fields, you can use SSL on name-based virtual hosts without further 776 workarounds.</p> 777 778 779 <h3><a name="vhosts2" id="vhosts2">Why is it not possible to use Name-Based 780 Virtual Hosting to identify different SSL virtual hosts?</a></h3> 781 <p>Name-Based Virtual Hosting is a very popular method of identifying 782 different virtual hosts. It allows you to use the same IP address and 783 the same port number for many different sites. When people move on to 784 SSL, it seems natural to assume that the same method can be used to have 785 lots of different SSL virtual hosts on the same server.</p> 786 787 <p>It is possible, but only if using a 2.2.12 or later web server, 788 built with 0.9.8j or later OpenSSL. This is because it requires a 789 feature that only the most recent revisions of the SSL 790 specification added, called Server Name Indication (SNI).</p> 791 792 <p>Note that if you have a wildcard SSL certificate, or a 793 certificate that has multiple hostnames on it using subjectAltName 794 fields, you can use SSL on name-based virtual hosts without further 795 workarounds.</p> 796 797 <p>The reason is that the SSL protocol is a separate layer which 798 encapsulates the HTTP protocol. So the SSL session is a separate 799 transaction, that takes place before the HTTP session has begun. 800 The server receives an SSL request on IP address X and port Y 801 (usually 443). Since the SSL request did not contain any Host: 802 field, the server had no way to decide which SSL virtual host to use. 803 Usually, it just used the first one it found which matched the 804 port and IP address specified.</p> 805 806 <p>If you are using a version of the web server and OpenSSL that 807 support SNI, though, and the client's browser also supports SNI, 808 then the hostname is included in the original SSL request, and the 809 web server can select the correct SSL virtual host.</p> 810 811 <p>You can, of course, use Name-Based Virtual Hosting to identify many 812 non-SSL virtual hosts (all on port 80, for example) and then 813 have a single SSL virtual host (on port 443). But if you do this, 814 you must make sure to put the non-SSL port number on the NameVirtualHost 815 directive, e.g.</p> 816 817 <div class="example"><p><code> 818 NameVirtualHost 192.168.1.1:80 819 </code></p></div> 820 821 <p>Other workaround solutions include: </p> 822 823 <p>Using separate IP addresses for different SSL hosts. 824 Using different port numbers for different SSL hosts.</p> 825 826 827 <h3><a name="comp" id="comp">How do I get SSL compression working?</a></h3> 828 <p>Although SSL compression negotiation was defined in the specification 829 of SSLv2 and TLS, it took until May 2004 for RFC 3749 to define DEFLATE as 830 a negotiable standard compression method. 831 </p> 832 <p>OpenSSL 0.9.8 started to support this by default when compiled with the 833 <code>zlib</code> option. If both the client and the server support compression, 834 it will be used. However, most clients still try to initially connect with an 835 SSLv2 Hello. As SSLv2 did not include an array of prefered compression algorithms 836 in its handshake, compression cannot be negotiated with these clients. 837 If the client disables support for SSLv2, either an SSLv3 or TLS Hello 838 may be sent, depending on which SSL library is used, and compression may 839 be set up. You can verify whether clients make use of SSL compression by 840 logging the <code>%{SSL_COMPRESS_METHOD}x</code> variable. 841 </p> 842 843 844 <h3><a name="lockicon" id="lockicon">When I use Basic Authentication over HTTPS 845 the lock icon in Netscape browsers stays unlocked when the dialog pops up. 846 Does this mean the username/password is being sent unencrypted?</a></h3> 847 <p>No, the username/password is transmitted encrypted. The icon in 848 Netscape browsers is not actually synchronized with the SSL/TLS layer. 849 It only toggles to the locked state when the first part of the actual 850 webpage data is transferred, which may confuse people. The Basic 851 Authentication facility is part of the HTTP layer, which is above 852 the SSL/TLS layer in HTTPS. Before any HTTP data communication takes 853 place in HTTPS, the SSL/TLS layer has already completed its handshake 854 phase, and switched to encrypted communication. So don't be 855 confused by this icon.</p> 856 857 858 <h3><a name="msie" id="msie">Why do I get I/O errors when connecting via 859 HTTPS to an Apache+mod_ssl server with Microsoft Internet Explorer (MSIE)?</a></h3> 860 <p>The first reason is that the SSL implementation in some MSIE versions has 861 some subtle bugs related to the HTTP keep-alive facility and the SSL close 862 notify alerts on socket connection close. Additionally the interaction 863 between SSL and HTTP/1.1 features are problematic in some MSIE versions. 864 You can work around these problems by forcing Apache not to use HTTP/1.1, 865 keep-alive connections or send the SSL close notify messages to MSIE clients. 866 This can be done by using the following directive in your SSL-aware 867 virtual host section:</p> 868 <div class="example"><p><code> 869 SetEnvIf User-Agent ".*MSIE.*" \<br /> 870 nokeepalive ssl-unclean-shutdown \<br /> 871 downgrade-1.0 force-response-1.0 872 </code></p></div> 873 <p>Further, some MSIE versions have problems with particular ciphers. 874 Unfortunately, it is not possible to implement a MSIE-specific 875 workaround for this, because the ciphers are needed as early as the 876 SSL handshake phase. So a MSIE-specific 877 <code class="directive"><a href="../mod/mod_setenvif.html#setenvif">SetEnvIf</a></code> won't solve these 878 problems. Instead, you will have to make more drastic 879 adjustments to the global parameters. Before you decide to do 880 this, make sure your clients really have problems. If not, do not 881 make these changes - they will affect <em>all</em> your clients, MSIE 882 or otherwise.</p> 883 884 <p>The next problem is that 56bit export versions of MSIE 5.x 885 browsers have a broken SSLv3 implementation, which interacts badly 886 with OpenSSL versions greater than 0.9.4. You can accept this and 887 require your clients to upgrade their browsers, you can downgrade to 888 OpenSSL 0.9.4 (not advised), or you can work around this, accepting 889 that your workaround will affect other browsers too:</p> 890 <div class="example"><p><code>SSLProtocol all -SSLv3</code></p></div> 891 <p>will completely disables the SSLv3 protocol and allow those 892 browsers to work. A better workaround is to disable only those 893 ciphers which cause trouble.</p> 894 <div class="example"><p><code>SSLCipherSuite 895 ALL:!ADH:<strong>!EXPORT56</strong>:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP</code> 896 </p></div> 897 898 <p>This also allows the broken MSIE versions to work, but only removes the 899 newer 56bit TLS ciphers.</p> 900 901 <p>Another problem with MSIE 5.x clients is that they refuse to connect to 902 URLs of the form <code>https://12.34.56.78/</code> (where IP-addresses are used 903 instead of the hostname), if the server is using the Server Gated 904 Cryptography (SGC) facility. This can only be avoided by using the fully 905 qualified domain name (FQDN) of the website in hyperlinks instead, because 906 MSIE 5.x has an error in the way it handles the SGC negotiation.</p> 907 908 <p>And finally there are versions of MSIE which seem to require that 909 an SSL session can be reused (a totally non standard-conforming 910 behaviour, of course). Connecting with those MSIE versions only work 911 if a SSL session cache is used. So, as a work-around, make sure you 912 are using a session cache (see the <code class="directive"><a href="../mod/mod_ssl.html#sslsessioncache">SSLSessionCache</a></code> directive).</p> 913 914 915 <h3><a name="nn" id="nn">Why do I get I/O errors, or the message "Netscape has 916 encountered bad data from the server", when connecting via 917 HTTPS to an Apache+mod_ssl server with Netscape Navigator?</a></h3> 918 <p> 919 This usually occurs when you have created a new server certificate for 920 a given domain, but had previously told your browser to always accept 921 the old server certificate. Once you clear the entry for the old 922 certificate from your browser, everything should be fine. Netscape's SSL 923 implementation is correct, so when you encounter I/O errors with Netscape 924 Navigator it is usually caused by the configured certificates.</p> 925 926 927 <h3><a name="javadh" id="javadh">Why do I get handshake failures with Java-based clients when using a certificate with more than 1024 bits?</a></h3> 928 <p>Beginning with version 2.2.30, 929 <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> will use DH parameters which include primes 930 with lengths of more than 1024 bits. Java 7 and earlier limit their 931 support for DH prime sizes to a maximum of 1024 bits, however.</p> 932 933 <p>If your Java-based client aborts with exceptions such as 934 <code>java.lang.RuntimeException: Could not generate DH keypair</code> and 935 <code>java.security.InvalidAlgorithmParameterException: Prime size must be 936 multiple of 64, and can only range from 512 to 1024 (inclusive)</code>, 937 and httpd logs <code>tlsv1 alert internal error (SSL alert number 80)</code> 938 (at <code class="directive"><a href="../mod/core.html#loglevel">LogLevel</a></code> <code>info</code> 939 or higher), you can either rearrange mod_ssl's cipher list with 940 <code class="directive"><a href="../mod/mod_ssl.html#sslciphersuite">SSLCipherSuite</a></code> 941 (possibly in conjunction with <code class="directive"><a href="../mod/mod_ssl.html#sslhonorcipherorder">SSLHonorCipherOrder</a></code>), 942 or you can use custom DH parameters with a 1024-bit prime, which 943 will always have precedence over any of the built-in DH parameters.</p> 944 945 <p>To generate custom DH parameters, use the <code>openssl dhparam 1024</code> 946 command. Alternatively, you can use the following standard 1024-bit DH 947 parameters from <a href="http://www.ietf.org/rfc/rfc2409.txt">RFC 2409</a>, 948 section 6.2:</p> 949 <div class="example"><pre>-----BEGIN DH PARAMETERS----- 950 MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR 951 Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL 952 /1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC 953 -----END DH PARAMETERS-----</pre></div> 954 <p>Add the custom parameters including the "BEGIN DH PARAMETERS" and 955 "END DH PARAMETERS" lines to the end of the first certificate file 956 you have configured using the 957 <code class="directive"><a href="../mod/mod_ssl.html#sslcertificatefile">SSLCertificateFile</a></code> directive.</p> 958 959 960 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 961 <div class="section"> 962 <h2><a name="support" id="support">mod_ssl Support</a></h2> 963 <ul> 964 <li><a href="#resources">What information resources are available in 965 case of mod_ssl problems?</a></li> 966 <li><a href="#contact">What support contacts are available in case of 967 mod_ssl problems?</a></li> 968 <li><a href="#reportdetails">What information should I 969 provide when writing a bug report?</a></li> 970 <li><a href="#coredumphelp">I had a core dump, can you help me?</a></li> 971 <li><a href="#backtrace">How do I get a backtrace, to help find the reason 972 for my core dump?</a></li> 973 </ul> 974 975 <h3><a name="resources" id="resources">What information resources are available in case of mod_ssl problems?</a></h3> 976 <p>The following information resources are available. 977 In case of problems you should search here first.</p> 978 979 <dl> 980 <dt>Answers in the User Manual's F.A.Q. List (this)</dt> 981 <dd><a href="http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html"> 982 http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html</a><br /> 983 First check the F.A.Q. (this text). If your problem is a common 984 one, it may have been answered several times before, and been included 985 in this doc. 986 </dd> 987 <dt>Postings from the modssl-users Support Mailing List 988 <a href="http://www.modssl.org/support/">http://www.modssl.org/support/</a></dt> 989 <dd>Search for your problem in the archives of the modssl-users mailing list. 990 You're probably not the first person to have had this problem! 991 </dd> 992 </dl> 993 994 995 <h3><a name="contact" id="contact">What support contacts are available in case 996 of mod_ssl problems?</a></h3> 997 <p>The following lists all support possibilities for mod_ssl, in order of 998 preference. Please go through these possibilities 999 <em>in this order</em> - don't just pick the one you like the look of. </p> 1000 <ol> 1001 <li><em>Send a Problem Report to the modssl-users Support Mailing List</em><br /> 1002 <a href="mailto:modssl-users@modssl.org"> 1003 modssl-users@modssl.org</a><br /> 1004 This is the preferred way of submitting your problem report, because this way, 1005 others can see the problem, and learn from any answers. You must subscribe to 1006 the list first, but you can then easily discuss your problem with both the 1007 author and the whole mod_ssl user community. 1008 </li> 1009 1010 <li><em>Send a Problem Report to the Apache httpd Users Support Mailing List</em><br /> 1011 <a href="mailto:users@httpd.apache.org"> 1012 users@httpd.apache.org</a><br /> 1013 This is the second way of submitting your problem report. Again, you must 1014 subscribe to the list first, but you can then easily discuss your problem 1015 with the whole Apache httpd user community. 1016 </li> 1017 1018 <li><em>Write a Problem Report in the Bug Database</em><br /> 1019 <a href="http://httpd.apache.org/bug_report.html"> 1020 http://httpd.apache.org/bug_report.html</a><br /> 1021 This is the last way of submitting your problem report. You should only 1022 do this if you've already posted to the mailing lists, and had no success. 1023 Please follow the instructions on the above page <em>carefully</em>. 1024 </li> 1025 </ol> 1026 1027 1028 <h3><a name="reportdetails" id="reportdetails">What information should I 1029 provide when writing a bug report?</a></h3> 1030 <p>You should always provide at least the following information:</p> 1031 1032 <dl> 1033 <dt>Apache and OpenSSL version information</dt> 1034 <dd>The Apache version can be determined 1035 by running <code>httpd -v</code>. The OpenSSL version can be 1036 determined by running <code>openssl version</code>. Alternatively, if 1037 you have Lynx installed, you can run the command <code>lynx -mime_header 1038 http://localhost/ | grep Server</code> to gather this information in a 1039 single step. 1040 </dd> 1041 1042 <dt>The details on how you built and installed Apache+mod_ssl+OpenSSL</dt> 1043 <dd>For this you can provide a logfile of your terminal session which shows 1044 the configuration and install steps. If this is not possible, you 1045 should at least provide the <code class="program"><a href="../programs/configure.html">configure</a></code> command line you used. 1046 </dd> 1047 1048 <dt>In case of core dumps please include a Backtrace</dt> 1049 <dd>If your Apache+mod_ssl+OpenSSL dumps its core, please attach 1050 a stack-frame ``backtrace'' (see <a href="#backtrace">below</a> 1051 for information on how to get this). This information is required 1052 in order to find a reason for your core dump. 1053 </dd> 1054 1055 <dt>A detailed description of your problem</dt> 1056 <dd>Don't laugh, we really mean it! Many problem reports don't 1057 include a description of what the actual problem is. Without this, 1058 it's very difficult for anyone to help you. So, it's in your own 1059 interest (you want the problem be solved, don't you?) to include as 1060 much detail as possible, please. Of course, you should still include 1061 all the essentials above too. 1062 </dd> 1063 </dl> 1064 1065 1066 <h3><a name="coredumphelp" id="coredumphelp">I had a core dump, can you help me?</a></h3> 1067 <p>In general no, at least not unless you provide more details about the code 1068 location where Apache dumped core. What is usually always required in 1069 order to help you is a backtrace (see next question). Without this 1070 information it is mostly impossible to find the problem and help you in 1071 fixing it.</p> 1072 1073 1074 <h3><a name="backtrace" id="backtrace">How do I get a backtrace, to help find 1075 the reason for my core dump?</a></h3> 1076 <p>Following are the steps you will need to complete, to get a backtrace:</p> 1077 <ol> 1078 <li>Make sure you have debugging symbols available, at least 1079 in Apache. On platforms where you use GCC/GDB, you will have to build 1080 Apache+mod_ssl with ``<code>OPTIM="-g -ggdb3"</code>'' to get this. On 1081 other platforms at least ``<code>OPTIM="-g"</code>'' is needed. 1082 </li> 1083 1084 <li>Start the server and try to reproduce the core-dump. For this you may 1085 want to use a directive like ``<code>CoreDumpDirectory /tmp</code>'' to 1086 make sure that the core-dump file can be written. This should result 1087 in a <code>/tmp/core</code> or <code>/tmp/httpd.core</code> file. If you 1088 don't get one of these, try running your server under a non-root UID. 1089 Many modern kernels do not allow a process to dump core after it has 1090 done a <code>setuid()</code> (unless it does an <code>exec()</code>) for 1091 security reasons (there can be privileged information left over in 1092 memory). If necessary, you can run <code>/path/to/httpd -X</code> 1093 manually to force Apache to not fork. 1094 </li> 1095 1096 <li>Analyze the core-dump. For this, run <code>gdb /path/to/httpd 1097 /tmp/httpd.core</code> or a similar command. In GDB, all you 1098 have to do then is to enter <code>bt</code>, and voila, you get the 1099 backtrace. For other debuggers consult your local debugger manual. 1100 </li> 1101 </ol> 1102 1103 </div></div> 1104 <div class="bottomlang"> 1105 <p><span>Available Languages: </span><a href="../en/ssl/ssl_faq.html" title="English"> en </a></p> 1106 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 1107 <script type="text/javascript"><!--//--><![CDATA[//><!-- 1108 var comments_shortname = 'httpd'; 1109 var comments_identifier = 'http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html'; 1110 (function(w, d) { 1111 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 1112 d.write('<div id="comments_thread"><\/div>'); 1113 var s = d.createElement('script'); 1114 s.type = 'text/javascript'; 1115 s.async = true; 1116 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 1117 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 1118 } 1119 else { 1120 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 1121 } 1122 })(window, document); 1123 //--><!]]></script></div><div id="footer"> 1124 <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 1125 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 1126 if (typeof(prettyPrint) !== 'undefined') { 1127 prettyPrint(); 1128 } 1129 //--><!]]></script> 1130 </body></html>