Installing a SSL certificate in 10.3.9 - I totally cant do it.

Question

Level 1

0 points

Installing a SSL certificate in 10.3.9 - I totally cant do it.

I have followed the instructions to the letter here:
http://developer.apple.com/server/security_ssl.html
and still I cannot start WEB after installing the certificate. The logs show various errors as shown below:

[Thu Jan 22 11:10:17 2009] [warn] module mod_WebObjects.c is already added, skipping
[Thu Jan 22 11:10:17 2009] [alert] httpd: Could not determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[Thu Jan 22 11:10:17 2009] [error] mod_ssl: Init: (www.website.co.nz:16080) Ops, no RSA or DSA server certificate found?!
[Thu Jan 22 11:10:17 2009] [error] mod_ssl: Init: (www.website.co.nz:16080) You have to perform a full server restart when you added or removed a certificate and/or key file
[Thu Jan 22 11:10:22 2009] [error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[Thu Jan 22 11:10:22 2009] [error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1 getobject:header too long
[Thu Jan 22 11:10:27 2009] [error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[Thu Jan 22 11:10:27 2009] [error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1 getobject:header too long
[Thu Jan 22 11:13:13 2009] [error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[Thu Jan 22 11:13:13 2009] [error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1 getobject:header too long

I can't understand why I keep getting pass phrase incorrect when I followed the document exactly and I have only one passphrase and it's been the same all the way through.

I hope someone can help because I'm going nuts here.

Apple, Mac OS X (10.4.11)

Posted on Jan 21, 2009 3:19 PM

Reply

Answer 1

Jan 21, 2009 4:08 PM in response to mwalford

10.3 has a huge issue with password protected ssl certs. Most of the issues surround the failure to properly use /etc/http/getsslpassphrase but there are other issues as well. Basically, Server Admin is useless for the configuration of virtual hosts using ssl certs. Use the apachectl command from terminal to start and stop apache and hand enter your ssl cert when prompted.

sudo apachectl start
sudo apachectl stop
sudo apacheclt graceful

Just remember that a reboot of your server will result in Apache failing to start. So plan accordingly and be prepared to manually start web services after a reboot.

Hope this helps - good luck keeping 10.3.9 running

Reply

Answer 2

mwalford Author

Level 1

0 points

Jan 21, 2009 4:47 PM in response to Strontium90

Hi there. I still have issues (apache not starting when SSL is on) but I really do appreciate your comments. Waiting on someone at Apple in NZL to get back to me.

Not my server so I can't say "just install 10.4" or something... Although I'd like to.

Once again, thanks for taking the time to read and reply.

Reply

Answer 3

Jan 21, 2009 5:06 PM in response to mwalford

When issuing the apachectl command what result do you get? What is the error reported in std out? If you less or cat your ssl certs, are they plain text with unix line breaks?

Reply

Answer 4

mwalford Author

Level 1

0 points

Jan 21, 2009 5:52 PM in response to Strontium90

Sorry, I don't understand "less or cat your ssl certs"

Please forgive my lack of experience.

Reply

Answer 5

Jan 22, 2009 4:03 AM in response to mwalford

These are commands to view text files. The reason I am asking you to use apachectl is that you may get better output on what the exact problem is. Also, it is very common to create your certs improperly. The less command will output the contents of the certs file. Use it like:

less /path/to/filename

Reply