fail to enable SSL in Fedora :(

Craig White craigwhite at azapple.com
Wed Dec 28 16:32:32 UTC 2005


On Wed, 2005-12-28 at 07:07 -0800, M E Fieu wrote:
> --- Craig White <craigwhite at azapple.com> wrote:
> > On Wed, 2005-12-28 at 02:28 -0800, M E Fieu wrote:
> > > Hi.. I tried to enable SSL / create a SSL Cert in my Fedora 3
> > > 
> > > I used the following to create server key 
> > > 
> > > openssl genrsa -des3 4096 >/etc/httpd/conf/ssl.key/server.key
> > > 
> > > then I make your a self signet cerificte with
> > > 
> > > openssl req -new -x509 -key /etc/httpd/conf/ssl.key/server.key -out >
> > > /etc/httpd/conf/ssl.crt/server.crt -days 365 -utf8
> > > 
> > > and then I ensure the following entries is in my ssl.conf
> > > SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
> > > SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
> > > 
> > > and restart my apache,  when I surf to https://mywebsite , it state page not found.
> > > http://mywebsite is ok.  and when I telnet port 443 to that server, it failed too.
> > > 
> > > The error_log show
> > > [Wed Dec 28 16:08:58 2005] [notice] LDAP: Built with OpenLDAP LDAP SDK
> > > [Wed Dec 28 16:08:58 2005] [notice] LDAP: SSL support unavailable
> > > [Wed Dec 28 16:08:58 2005] [notice] Apache/2.0.53 (Fedora) configured -- resuming normal
> > > operations
> > > [Wed Dec 28 17:59:16 2005] [notice] caught SIGTERM, shutting down
> > > [Wed Dec 28 17:59:17 2005] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
> > > [Wed Dec 28 17:59:17 2005] [notice] Digest: generating secret for digest authentication ...
> > > [Wed Dec 28 17:59:17 2005] [notice] Digest: done
> > > 
> > > I also tried to create a CSR to submit to my windows domain Root CA to sign it
> > > http://windowsCA/certsrv/  Can anyone tell me whether windows domain CA and sign Linux CSR?
> > > 
> > > I used the following command to create CSR of my Linux box
> > > openssl req -new -key /etc/httpd/conf/ssl.key/server.key -out
> > /etc/httpd/conf/ssl.key/server.csr
> > > 
> > > and use the server.csr content to http://windowsCA/certsrv/ and the windows CA can sign it and
> > > return as certnew.cer.  It rename it as server.crt and move it to my linux box's
> > > /etc/httpd/conf/ssl.crt/server.crt  and restart the apache.  Not sure whether it is right ,
> > but I
> > > also can't telnet 443 to my linux box and error message is the same as above
> > ----
> > this is how I do it.
> > 
> > cd /usr/share/ssl/certs
> > 
> > openssl genrsa -des3 -out ca.key 2048
> > openssl genrsa -des3 -out server.key 1024
> > 
> > #### generate web server certificate ####
> > openssl rsa -in server.key -out server.key.unsecure
> > openssl req -config /usr/share/ssl/openssl.cnf -new -x509 -days 3650 \
> > -key server.key.unsecure -out server.crt
> > rm -fr /etc/httpd/conf/ssl.crt/server.crt
> > cp server.crt /etc/httpd/conf/ssl.crt/
> > rm -fr /etc/httpd/conf/ssl.key/server.key
> > cp server.key.unsecure /etc/httpd/conf/ssl.key/server.key
> 
> Hi.. thanks I have followed what you have shown me but I still get the same error message and I
> can't telnet 443 to my box same as before. :(
----
what does it say in /var/log/httpd/ssl_error_log?
----
> 
> can you tell me what is mean by "openssl rsa -in server.key -out server.key.unsecure", what is
> "in" and "out" and what is the difference between server.key and server.key.unsecure ???
----
I believe the point is to create without the need to enter a password to
start httpd
----
> 
> also "openssl req -config /usr/share/ssl/openssl.cnf -new -x509 -days 3650 \ -key
> server.key.unsecure -out server.crt"
> 
> it mean CA to signing server.crt with server private key server.key.unsecure?  Why ca.key that
> created has never been used in the process?  
----
yeah, that snippet is only one of many certificates that I create and
the ca.key is used later on (to make certs for openldap)

Craig




More information about the fedora-list mailing list