Bug 144274

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5)
Gecko/20041111 Firefox/1.0

Description of problem:
I am trying to generate a self signed ssl certificate for testing my
machine. I follow the folling steps to create my own key:

to delete the dummy keys that are default with FC3
rm -f /etc/httpd.conf/ssl.crt/server.crt \
/etc/httpd.conf/ssl.key/server.key

then create a new key
cd /usr/share/ssl/certs/
make genkey

now to create the cert

cd /usr/share/ssl/certs/
make testcert

now when i go to start my httpd service i get this error:

service httpd start

Starting httpd: Apache/2.0.52 mod_ssl/2.0.52 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server server.domain.co.uk:443 (RSA)
Enter pass phrase:Apache:mod_ssl:Error: Private key not found.
**Stopped
[FAILED]

I dont even get as far as entering the password for the key.
This would suggest that the server.key file isnt in
/etc/httpd/conf/ssl.key but i have checked and it is.
Also /etc/httpd/conf.d/ssl.conf correctly points to this file as well.

The out put of my ssl_errors.log is:
[Wed Jan 05 14:33:45 2005] [error] Init: Unable to read pass phrase
[Hint: key introduced or changed before restart?]
[Wed Jan 05 14:33:45 2005] [error] SSL Library Error: 218710120
error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Wed Jan 05 14:33:45 2005] [error] SSL Library Error: 218529960
error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Wed Jan 05 14:33:45 2005] [error] SSL Library Error: 218595386
error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Wed Jan 05 14:33:45 2005] [error] SSL Library Error: 218734605
error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

There is also this output from dmesg:

SELinux: initialized (dev 0:13, type nfs), uses genfs_contexts
audit(1104934858.355:0): avc:  denied  { getattr } for  pid=3695
exe=/usr/sbin/httpd path=/etc/httpd/conf.d/ssl.conf dev=dm-0 ino=32789
scontext=root:system_r:httpd_t tcontext=root:object_r:user_home_t
tclass=file
audit(1104934858.356:0): avc:  denied  { read } for  pid=3695
exe=/usr/sbin/httpd name=ssl.conf dev=dm-0 ino=32789
scontext=root:system_r:httpd_t tcontext=root:object_r:user_home_t
tclass=file
audit(1104934951.020:0): avc:  denied  { getattr } for  pid=3708
exe=/usr/sbin/httpd path=/etc/httpd/conf.d/ssl.conf dev=dm-0 ino=32789
scontext=root:system_r:httpd_t tcontext=root:object_r:user_home_t
tclass=file
audit(1104934951.020:0): avc:  denied  { read } for  pid=3708
exe=/usr/sbin/httpd name=ssl.conf dev=dm-0 ino=32789
scontext=root:system_r:httpd_t tcontext=root:object_r:user_home_t
tclass=file


I have also tried with a test certificate from freessl.com but the
same thing happens.


Version-Release number of selected component (if applicable):
kernel 2.6.9-1.724_FC,httpd-2.0.52-3.1, mod_ssl-2.0.52-3.1 and
openssl-0.9.7a-4

How reproducible:
Always

Steps to Reproduce:
1.delete current key + cert
rm -f /etc/httpd.conf/ssl.crt/server.crt \
/etc/httpd.conf/ssl.key/server.key
2.then create a new key
cd /usr/share/ssl/certs/
make genkey

3.create a new cert 
cd /usr/share/ssl/certs/
make testcert

4. start apache
service httpd start



    

Actual Results:  Starting httpd: Apache/2.0.52 mod_ssl/2.0.52 (Pass
Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server server.domain.co.uk:443 (RSA)
Enter pass phrase:Apache:mod_ssl:Error: Private key not found.
**Stopped
[FAILED]

Expected Results:  apache to start and be able to serve ssl encypted
pages.

Additional info:

The install is a standard install. The ssl.conf file hasnt been
modified in any way and the passwords used for the server.key dont
have any special chars in them