Hi all,
I searched the mailing list archive and uncovered some problems in the
past with this, there doesn't seem to be any evidence of a solution.
I installed modssl into Apache by following the instructions inside
INSTALL. The Apache server starts up without a problem. I point Netscape
at my newly configured test SSL enabled virtual host using the default
www.snakeoil.dom certificate. I expect to see a message from Netscape
complaining that the cert isn't recognised as signed by a valid CA and
that it doesn't match the servername, but instead I get an error message
that Netscape cannot negotiate a common encryption algorithm.
My config looks like this:
global:
SSLMutex file:/tmp/apache.ssl.mutex
SSLPassPhraseDialog builtin
#SSLSessionCache shm:/opt/local/apache/logs/ssl_gcache_data(512000)
SSLSessionCache dbm:/opt/local/apache/logs/ssl_gcache_data
SSLEngine off
SSLProtocol all
SSLLog /opt/local/apache/logs/ssl_engine_log
SSLLogLevel warn
virtual host:
SSLEngine on
SSLCertificateFile /opt/local/apache/conf/ssl.crt/snakeoil-dsa.crt
SSLCertificateKeyFile /opt/local/apache/conf/ssl.key/snakeoil-dsa.key
SSLVerifyClient none
SSLVerifyDepth 1
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
An attempt to connect to the secure server using s_client looks like
this:
[9:18pm] root@infobase:/opt/local/apache/conf#
/opt/local/ssl/bin/s_client -connect 193.78.100.33:443
CONNECTED(00000003)
depth=0 /C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Webserver
[EMAIL PROTECTED]
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Webserver
[EMAIL PROTECTED]
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Webserver
[EMAIL PROTECTED]
i:/C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Certificate
Authority/CN=Snake Oil [EMAIL PROTECTED]
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDnzCCA1ygAwIBAgIBFTALBgcqhkjOOAQDBQAwgakxCzAJBgNVBAYTAlhZMRUw
EwYDVQQIEwxTbmFrZSBEZXNlcnQxEzARBgNVBAcTClNuYWtlIFRvd24xFzAVBgNV
BAoTDlNuYWtlIE9pbCwgTHRkMR4wHAYDVQQLExVDZXJ0aWZpY2F0ZSBBdXRob3Jp
dHkxFTATBgNVBAMTDFNuYWtlIE9pbCBDQTEeMBwGCSqGSIb3DQEJARYPY2FAc25h
a2VvaWwuZG9tMB4XDTk5MDIyNTEzMjgzMloXDTAwMDIyNTEzMjgzMlowgacxCzAJ
BgNVBAYTAlhZMRUwEwYDVQQIEwxTbmFrZSBEZXNlcnQxEzARBgNVBAcTClNuYWtl
IFRvd24xFzAVBgNVBAoTDlNuYWtlIE9pbCwgTHRkMRcwFQYDVQQLEw5XZWJzZXJ2
ZXIgVGVhbTEZMBcGA1UEAxMQd3d3LnNuYWtlb2lsLmRvbTEfMB0GCSqGSIb3DQEJ
ARYQd3d3QHNuYWtlb2lsLmRvbTCCAbYwggErBgcqhkjOOAQBMIIBHgKBgQDqP04J
h4QoUWqPJZftxsgLdO54hGmvEYr2o2nqMjO/DbVuujr8QDnVWNRveEuVdrx6AftC
chgIvdJS4LTqfvgOmIwsGYylADmycIRlBVHd5q1ocGldkeEBiY+cS5yv8ro1x4DR
Cd0axmhBvTu2BRbippaK7PNALw5xs8eQch0KLQIVAJ8rT8F7NqIRASUjy1Bwx701
zSIfAoGAT5RMEmjJ4HXOJ0GyIKAesFQhOy3gXXUfV4zXTpSMz8cQWfTqxLgVjkvZ
Ct6SYcNmpaRnJyrmUdGD2uSwBcMkXj3G/NI/7n1C6ZuBTt1x6TCQA72nYh0xQaj/
kbmhT2wNyONMx/sZO/WPUr0qvu/012FS2YlKtq3wRM4+XHz7jY0DgYQAAoGAHX6Q
e2/rMmZewuBxGtyyzzRt7UJcc4c8y2JNRctygdxwGsZD06i6reR8l6wIaLFhZl8b
3DkLNvzssTXsOcR7x82bv9vmknLvjQk3FRJvmfpSAPcNRBUk/1L8UKHkfAP6B31A
h7tRlG36W/iBw1cighqTnDxnNDqv6Wgbd7REtxSjFTATMBEGCWCGSAGG+EIBAQQE
AwIAQDALBgcqhkjOOAQDBQADMAAwLQIUTpfmWwLjKYJFFX5p8fvra8No7CwCFQCL
0q3LdCx1EsUtmsgakN6Yru18Fw==
-----END CERTIFICATE-----
subject=/C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Webserver
[EMAIL PROTECTED]
issuer=/C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil,
Ltd/OU=Certificate Authority/CN=Snake Oil [EMAIL PROTECTED]
---
No client certificate CA names sent
---
SSL handshake has read 1406 bytes and written 293 bytes
---
New, TLSv1/SSLv3, Cipher is EDH-DSS-DES-CBC3-SHA
Server public key is 1024 bit
SSL-Session:
Protocol : TLSv1
Cipher : EDH-DSS-DES-CBC3-SHA
Session-ID:
4F183CB19529E3A19031FF7FA8EEC2790A6997A3139A9B3ED5C3E64C1A5F4CC3
Session-ID-ctx:
Master-Key:
1D56208BDCC74A34D683292E1B2D0DDDE778D6A9B7246F5A5C33256EE201E36A8D169D129FC587304D9EFB9C1F00A810
Key-Arg : None
Start Time: 935608696
Timeout : 300 (sec)
---
Does anyone have any idea what's wrong?
Regards,
Graham
--
-----------------------------------------
[EMAIL PROTECTED] "There's a moon
over Bourbon Street
tonight...
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
