Bug 221898

Created attachment 145096 [details]
strace httpd log file.

Can you attach the error_log (or the last ~50 lines of it)?  There are no
obvious errors in the strace output.

I've looked at #4485. No Luck there..

The system will not record to the error.log. It hangs and therefor it never writes to the log file. 

Here's what happens.

root@terasembot log]# gdb httpd
GNU gdb Red Hat Linux (6.3.0.0-1.134.fc5rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) b ap_process_request
Breakpoint 1 at 0x34676
(gdb) run -X -d /etc/httpd
Starting program: /usr/sbin/httpd -X -d /etc/httpd
Reading symbols from shared object read from target memory...(no debugging symbols found)...done.
Loaded system supplied DSO at 0xa84000
(no debugging symbols found)
Breakpoint 1 at 0x778676
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread -1208523088 (LWP 25897)]
(no debugging symbols found)
(no debugging symbols found)
---Type <return> to continue, or q <return> to quit---
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)

-----   STOPS HERE - NOTHING MORE ----- still running as of this report. waited 1/2 hour to
-----   complete. nothing. 

opened 2nd window

no break point entered.

(gdb) thread apply all bt full
(gdb) q
[root@terasembot tmp]# cd /
[root@terasembot /]# cd tmp
[root@terasembot tmp]# ls -al
total 1288
drwxrwxrwt 11 root   root     4096 Jan  8 08:30 .
drwxr-xr-x 23 root   root     4096 Jan  8 08:29 ..
-rw-r--r--  1 root   root        0 Jan  8 08:30 error_log
drwxrwxrwt  2 root   root     4096 Jan  5 15:56 .font-unix
drwx------  3 root   root     4096 Jan  5 15:56 gconfd-root

after about 2-3 hours, it dissappears from ps -aux, No error given. Log log file.

that's it..

Sorry, the relevant log file is /etc/httpd/logs/ssl_error_log, can you attach that?

ah that one I never looked at..

Here is the later end of the file.

[Mon Jan 08 13:34:58 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 13:35:20 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 13:35:20 2007] [info] Init: Requesting pass phrase via builtin terminal dialog
[Mon Jan 08 13:35:25 2007] [debug] ssl_engine_pphrase.c(475): encrypted RSA private key - pass 
phrase requested
[Mon Jan 08 13:35:26 2007] [info] Configuring server for SSL protocol
[Mon Jan 08 13:35:26 2007] [debug] ssl_engine_init.c(405): Creating new SSL context (protocols: SSLv3, 
TLSv1)
[Mon Jan 08 13:35:26 2007] [warn] Init: Oops, you want to request client authentication, but no CAs are 
known for verification!?  [Hint: SSLCACertificate*]
[Mon Jan 08 13:35:26 2007] [debug] ssl_engine_init.c(601): Configuring permitted SSL ciphers [ALL:!
ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW]
[Mon Jan 08 13:35:26 2007] [debug] ssl_engine_init.c(729): Configuring RSA server certificate
[Mon Jan 08 13:35:26 2007] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == 
TRUE !?)
[Mon Jan 08 13:35:26 2007] [warn] RSA server certificate CommonName (CN) `terasembot' does NOT 
match server name!?
[Mon Jan 08 13:35:26 2007] [debug] ssl_engine_init.c(768): Configuring RSA server private key
[Mon Jan 08 13:35:26 2007] [error] Unable to configure RSA server private key
[Mon Jan 08 13:35:26 2007] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate 
routines:X509_check_private_key:key values mismatch
[Mon Jan 08 13:45:18 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 13:45:18 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 13:58:51 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 13:58:51 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:04:28 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:04:28 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:17:26 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:17:26 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:22:09 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:22:09 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:41:41 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:41:41 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:43:05 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:43:05 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 14:43:56 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 14:43:56 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 15:37:37 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 15:37:37 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 15:42:40 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 15:42:40 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 16:04:41 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 16:04:41 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 16:28:26 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 16:28:26 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]
[Mon Jan 08 16:58:35 2007] [info] Loading certificate & private key of SSL-aware server
[Mon Jan 08 16:58:35 2007] [error] Server should be SSL-aware but has no certificate configured [Hint: 
SSLCertificateFile]

The relevant section is:

[Mon Jan 08 13:35:26 2007] [debug] ssl_engine_init.c(768): Configuring RSA
server private key
[Mon Jan 08 13:35:26 2007] [error] Unable to configure RSA server private key
[Mon Jan 08 13:35:26 2007] [error] SSL Library Error: 185073780
error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

which occurs when you have a mis-matched certificate and private key in an SSL
vhost.  Check that the key file specified by SSLCertificateKeyFile matches
the certificate specified by SSLCertificateFile in /etc/httpd/conf.d/ssl.conf.

Please follow up on fedora-list if you have further problems since
this is a configuration issue not a software bug.

#   Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate.  If
# the certificate is encrypted, then you will be prompted for a
# pass phrase.  Note that a kill -HUP will prompt again.  A new
# certificate can be generated using the genkey(1) command.
SSLCertificateFile /etc/pki/tls/certs/localhost.crt

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

same problem.

Created attachment 145188 [details]
ssl_conf

what's wrong with this file?