You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Matteo Corti <ma...@id.ethz.ch> on 2006/07/04 16:59:34 UTC
[users@httpd] segmentation fault with SSLCertificateChainFile
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
I am managing several web servers with a very similar configuration. On
one instance I get a segmentation fault if I specify the
SSLCertificateChainFile option (I am using 2.0.58).
If I remove the directive the problem disappears.
- - the certificate file is OK (it is the very same file I use for other
instances which are working w/o problems)
- - executing httpd with strace I get the following
[...]
fcntl64(10, F_SETLKW, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0
open("/etc/apache/vhosts/129.132.46.76/conf/ssl.crt/sureserverEDU.pem",
O_RDONLY|O_LARGEFILE) = 11
- --- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
- - the log files (LogLevel debug) do not show anything useful
[Tue Jul 04 16:57:41 2006] [info] PAM: mod_auth_pam/2.0-1.1
[Tue Jul 04 16:57:41 2006] [info] Init: Initializing OpenSSL library
[Tue Jul 04 16:57:41 2006] [info] Init: Seeding PRNG with 136 bytes of
entropy
[Tue Jul 04 16:57:41 2006] [info] Loading certificate & private key of
SSL-aware server
[Tue Jul 04 16:57:41 2006] [info] Init: Requesting pass phrase from
dialog filter program (/etc/apache/vhosts/129.132.46.76/conf/ssl.key/dialog)
[Tue Jul 04 16:57:41 2006] [debug] ssl_engine_pphrase.c(475): encrypted
RSA private key - pass phrase requested
[Tue Jul 04 16:57:41 2006] [info] Init: Wiped out the queried pass
phrases from memory
[Tue Jul 04 16:57:41 2006] [info] Init: Generating temporary RSA private
keys (512/1024 bits)
[Tue Jul 04 16:57:41 2006] [info] Init: Generating temporary DH
parameters (512/1024 bits)
[Tue Jul 04 16:57:41 2006] [debug] ssl_scache_dbm.c(404): Inter-Process
Session Cache (DBM) Expiry: old: 0, new: 0, removed: 0
[Tue Jul 04 16:57:41 2006] [info] Init: Initializing (virtual) servers
for SSL
[Tue Jul 04 16:57:41 2006] [info] Configuring server for SSL protocol
[Tue Jul 04 16:57:41 2006] [debug] ssl_engine_init.c(405): Creating new
SSL context (protocols: SSLv2, SSLv3, TLSv1)
[Tue Jul 04 16:57:41 2006] [debug] ssl_engine_init.c(588): Configuring
permitted SSL ciphers
[ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL]
Do you have idea what I could try or where else I could look for info?
Many thanks in advance
Matteo
- --
Matteo Corti
ETH Zurich
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFEqoJVLEG/T0gggJsRAlwZAKCRUlk1SWl08iszlb6GEHZO4XDfLgCfW8ux
ZeoWVo+2534Xsn16ik2+Ay0=
=NF3r
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] segmentation fault with SSLCertificateChainFile
Posted by Matteo Corti <ma...@id.ethz.ch>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Joshua Slive wrote:
> On 7/4/06, Matteo Corti <ma...@id.ethz.ch> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi,
>>
>> I am managing several web servers with a very similar configuration. On
>> one instance I get a segmentation fault if I specify the
>> SSLCertificateChainFile option (I am using 2.0.58).
>>
>> If I remove the directive the problem disappears.
>>
>> - - the certificate file is OK (it is the very same file I use for other
>> instances which are working w/o problems)
>>
>> - - executing httpd with strace I get the following
>>
>
> http://httpd.apache.org/dev/debugging.html
>
Dear Joshua.
many thanks but I hoped that there was something easier that I was
missing. In any case I recompiled httpd with debugging support and
discovered the following:
httpd is crashing in
0x0044feaa in sk_pop_free () from
/usr/pack/openssl-0.9.8b-mc/lib/libcrypto.so.0.9.8
(gdb) bt
#0 0x0051f39a in sk_pop_free () from
/usr/pack/openssl-0.9.8b-mc/lib/libcrypto.so.0.9.8
#1 0x0928e458 in ?? ()
#2 0x092dcb50 in ?? ()
#3 0xbfffc4c8 in ?? ()
#4 0x0040d9f7 in SSL_CTX_use_certificate_chain (ctx=0x0, file=0xc14d90
"S\203ì\fè", skipfirst=16302628, cb=0x3fc820
<ssl_config_global_isfixed>) at ssl_util_ssl.c:488
Previous frame inner to this frame (corrupt stack?)
Now: I know that I could begin to analyze the sources and debug them to
see why it is crashing but my laziness makes me ask again if someone had
some previous experience with a similar problem (i.e., segfaults using
chained SSL certificates).
If this a new issue I suppose I'll have to dig into the source by myself :-)
Thanks again,
Matteo Corti
- --
Matteo Corti
ETH Zurich
Informatikdienste / Basisdienste
matteo.corti@id.ethz.ch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFEq99iLEG/T0gggJsRAk8dAKCYs4+tFskt6QxLLM9oNmzQTvtXVACgoLJj
TQBIn7BxW6djpFisodihU5A=
=YXDT
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] segmentation fault with SSLCertificateChainFile
Posted by Joshua Slive <jo...@slive.ca>.
On 7/4/06, Matteo Corti <ma...@id.ethz.ch> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> I am managing several web servers with a very similar configuration. On
> one instance I get a segmentation fault if I specify the
> SSLCertificateChainFile option (I am using 2.0.58).
>
> If I remove the directive the problem disappears.
>
> - - the certificate file is OK (it is the very same file I use for other
> instances which are working w/o problems)
>
> - - executing httpd with strace I get the following
>
http://httpd.apache.org/dev/debugging.html
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org