Ssl error preventing apache from starting

httpdssl

Today I installed monit on a production server because mysqld periodically falls over.
After a few hours, monit tried to restart apache, but failed, and I am unable to start it manually.

The error is:

[error] Unable to configure verify locations for client authentication
[Sat Dec 12 05:32:49 2015] [error] SSL Library Error: 151441510 error:0906D066:PEM routines:PEM_read_bio:bad end line
[Sat Dec 12 05:32:49 2015] [error] SSL Library Error: 185090057 error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib

A check of file dates shows that none of the certificate files have suddenly been corrupted (all have dates from a month ago), nor has /etc/httpd/conf.d/ssl.conf

I think I successfully restarted apache about a week ago.
What is the best way to get the site up again (with or without SSL)

Mysql version – 5.5.46
CentOS version – 6.7
Apache version – 2.2.15

Best Answer

In the end it was an error in the ca-bundle file formatting. I had discounted that initially, because the site had been working happily for a month on https: Go figure.

Related Solutions

SSL Certificate – How to Download SSL Certificate from a Website

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Ssl – ZendServer, Apache2 and VirtualHosts with SSL

Did you enable the SSL module using "a2enmod"? This is analogous to the sites-available/sites-enabled thing, where symlinks are created from mods-enabled to the files in mods-available.

To use the IP address, you will put it in the VirtualHost line, something like <VirtualHost 192.168.1.1:443>.

Best Answer

Related Solutions

SSL Certificate – How to Download SSL Certificate from a Website

Ssl – ZendServer, Apache2 and VirtualHosts with SSL

Related Topic