5

I'm on RHEL 6.5 and Apache 2.2.15. When I restart the httpd, I can not start that httpd anymore. Showing following things in the /var/log/httpd/error_log:

[Fri Aug 01 18:31:48 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:32:35 2014] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Fri Aug 01 18:32:35 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:42:46 2014] [notice] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Fri Aug 01 18:42:46 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:43:15 2014] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Fri Aug 01 18:43:15 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:43:59 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:44:12 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Fri Aug 01 18:45:03 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

Actually I have already disabled the SELinux and rebooted.
What should I do please?

  • 1
    These aren't errors, they're just notices. You might need to post more of the error log. – Bratchley Aug 4 '14 at 2:35
  • These messages are not revelent to the non-startup of httpd....please provide log information that is more revelent (i.e. not notice level...but error level or above). – mdpc Aug 4 '14 at 3:22
  • Also, errors that occur before httpd fully starts may not even goto the error log. Try starting the httpd process manually to inspect stdout. – jordanm Aug 4 '14 at 3:23
  • But whenever i try service httpd start it failed and a new error lines been added, as like above. **Actually i'm applying the SSL. – 夏期劇場 Aug 4 '14 at 10:06
9

Sorry, I have found the reason. This is totally because of the SSL CERT problem. Not really because of above notices.


It was nothing to do with above mentioned Messages.
Therefore please just ignore them.


How do I do was that I enabled the Apache Detailed Logs and then that's the real move. It shows what really is happening, by showing the Failure at the loading of mod_ssl module, while starting the Apache. Then I realized it is because of ssl.conf (or the respective Vhost file) having the SSL Cert configurations inside.

There I made 2 mistakes. First, I didn't give read permissions to the CERT related files (.crt/ .key/ .csr). After that, more badly, one of the file was wrong.

  • Your answer helped me figure out an SSL related problem causing the SELinux error above. In my case I was missing SSLEngine on in my vhost conf Interestingly service httpd configtest did not show any errors – John Jul 25 '17 at 14:36
2
Apache Error [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

One fine morning I have discovered that my Apache (httpd) service is down and can't be started :)

Step 1: Checking httpd Service Status:

#/etc/init.d/httpd status

httpd dead but pid file exists

Step 2: Search httpd processes and kill those

#ps -ef | grep httpd

# killall -9 httpd

Step 3: Remove httpd lock file if exist

# rm -f /var/lock/subsys/httpd

Step4: Restart Apache/httpd Service

# service httpd restart
Stop httpd    [FAILED]
Start httpd   [FAILED]

Need to dig down more.

Step 5: Check httpd error log file

# grep suexec /var/log/httpd/error_log
[Sun Sep 22 10:32:06 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Sep 22 10:33:51 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Sep 22 10:38:03 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Sep 22 10:45:53 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

Step 6: Check httpd nss error log file

#tail -300 /var/log/httpd/nss_error_log
[Sun Sep 22 04:03:27 2013] [error] Certificate not verified: 'Server-Cert'
[Sun Sep 22 04:03:27 2013] [error] SSL Library Error: -8181 Certificate has expired
[Sun Sep 22 04:03:27 2013] [error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

[Sun Sep 22 10:38:03 2013] [error] Certificate not verified: 'Server-Cert'
[Sun Sep 22 10:38:03 2013] [error] SSL Library Error: -8181 Certificate has expired
[Sun Sep 22 10:38:03 2013] [error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.
[Sun Sep 22 10:45:53 2013] [error] Certificate not verified: 'Server-Cert'
[Sun Sep 22 10:45:53 2013] [error] SSL Library Error: -8181 Certificate has expired
[Sun Sep 22 10:45:53 2013] [error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

root cause of this issue is in a module called nss. mod_nss is an alternative to mod_ssl; it does a few things that mod_ssl doesn't do, and can run along side mod_ssl. For more information's, please go through the links [What is mod_nss , On Setting up Mod_NSS ,More detail ]

Step 7: Remove nss.conf file from httpd conf.d directory

#cd /etc/httpd/conf.d
#mv nss.conf nss.conf.orig
#mv ssl.conf ssl.conf.orig
#/etc/init.d/httpd start
Start httpd   [OK]
  • 1
    Welcome to U&L. Don't forget to read the help page on formatting. – garethTheRed Mar 9 '16 at 19:22
0

This one fixed my issue.

yumpurge () 
{ 
    if [[ $# -eq 0 ]]; then
        echo "usage:
            removes packages including config files
            example:
            $0 ['pkg1 pkg2 pkgn']
            ";
        return 0;
    fi;
    for package in "$*";
    do
        echo "removing config files for $package";
        for file in $(rpm -q --configfiles $package);
        do
            echo "removing $file";
            echo "enter any key to confirm";
            rm -i -f $file;
        done;
        rpm -e $package;
    done
}


yumpurge  mod_ssl   httpd
yum install -y httpd mod_ssl
-1

I corrected that by re-installing the mod_ssl in CentOS 6 with yum erase mod_ssl and installing it with yum mod_ssl. That should fix it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.