0

Trying to start httpd and I see the following in the error log,

[Mon Apr 12 21:00:13.398987 2021] [suexec:notice] [pid 155] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Apr 12 21:00:13.399247 2021] [ssl:emerg] [pid 155] AH02572: Failed to configure at least one certificate and key for myHost.net:443
[Mon Apr 12 21:00:13.399265 2021] [ssl:emerg] [pid 155] SSL Library Error: error:140A80B1:SSL routines:SSL_CTX_check_private_key:no certificate assigned
[Mon Apr 12 21:00:13.399270 2021] [ssl:emerg] [pid 155] AH02312: Fatal error initialising mod_ssl, exiting.

Within /var/www/test I created self signed files via

bash-4.2# openssl req -new -x509 -nodes -out server.crt -keyout server.key
Generating a 2048 bit RSA private key
........+++
..................................................................................+++
writing new private key to 'server.key'
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:NJ
Locality Name (eg, city) [Default City]:Princeton
Organization Name (eg, company) [Default Company Ltd]:Acme
Organizational Unit Name (eg, section) []:Dev
Common Name (eg, your name or your server's hostname) []:myHost.net
Email Address []:a@z.com

The /etc/httpd/conf.d/ssl.conf file contains,

<VirtualHost _default_:443>
SSLEngine on
SSLProtocol all -SSLv3
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA
ServerName myHost.net
SSLCertificateFile /var/www/test/server.crt
SSLCertificateKeyFile /var/www/test/server.key
Include /etc/httpd/conf.d/options-ssl-apache.conf
</VirtualHost>

/etc/httpd/conf.d/options-ssl-apache.conf has

SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

/etc/httpd/conf.modules.d/00-ssl.conf has

LoadModule ssl_module modules/mod_ssl.so

This is within a Docker container,

bash-4.2# cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"

The bottom of httpd.conf contains

IncludeOptional conf.d/*.conf

Any pointers on where to look given slightly ambiguous error?

Many thanks

3
  • Why do you have the directives both in <VirtualHost> and then in the other file that you include? Start with a simple configuration file, with just one host, and only when it works organize configuration the way you want. I suspect the second SSLEngin on in the included file to "overwrite" the results of SSLCertificateFile and SSLCertificateKeyFile – Patrick Mevzek Apr 23 at 3:32
  • Not related to your problem but note that certificates nowadays need to have a SAN section with the hostname, as only what is in CN (Common Name) is either ignored or used only as fallback by browsers. Alternatively, just use LE or some other equivalent CA to get free and fully recognized non self-signed certificates (but again, that won't solve your immediate problem that is probably more related to your configuration, do make sure however 100% that the files referenced in configuration are correct one for key and certificate, and not some mix with other things) – Patrick Mevzek Apr 23 at 3:34
  • The problem I describe in my above comment seems to be exactly what is offered as a solution on this other question: stackoverflow.com/a/56816352/6368697 – Patrick Mevzek Apr 23 at 3:40
1

As a wild guess, try moving certificate/key out of /var/www.

A second thought: permissions on key file might be too wide (this answer suggests permissions should be 600 on certificate and key files and 700 on containing directory, owned by root).

3
  • I agree, putting the key in /var/www is likely going to cause the issue. It’s a dangerous place to keep in, because httpd expects to serve content from there to clients, and the key should be private. Typically on rhel-based OSs, the ssl keys are in /etc/pki/tls or a sub directory in/etc/httpd. (Those directories get the right SELinux context automatically) – jsbillings Apr 13 at 0:20
  • Thank you for the suggestions. The files were moved to /etc/httpd and permissions set to 600. The error continues though. Is there a verbose debug flag for ssl module that can be turned on perhaps? – Bill Apr 13 at 0:46
  • Regarding verbosity, LogLevel should be enough to get more. – Patrick Mevzek Apr 23 at 3:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.