SSL Problems. . .

[RobotDeathSquad]

I’m trying to install an SSL cert from the command line. I believe I have it installed correct, but I get the following error and all connections made over HTTPS are recjected.

Heres’ the error:

error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long

I’ve checked the key and the crt in both pico and vim to make sure there were not incorrect characters, and I didn’t see any. I see lots of people on the net have this problem but I see no fixes.

Any help anyone?

[RobotDeathSquad]

I removed the passphrase, but I’m still getting connection refused when I try to load the secure site.

I’m using Panther Client as my OS so I don’t use the apple tools. Can someone post a sample of their apache configs that the apple tools create (relevant parts only ).

Thanks

[Anonymous]

I’d like to add my voice to this problem as I get the same thing in addition to an invalid pass phrase error.

I tried to use MacTroll’s article (https://www.afp548.com/articles/panther/sslinfo.html) to set up SSL on my panther server. BTW, Thanks Mactroll, for going to the trouble.

I am reasonably confident I followed the steps (several times) but I keep getting an Invalid pass phrase error when I enable SSL and start the service. The only thing I can think of is the common name. I made it the fully qualified name required for DNS resolution although I am a little fuzzy on what ‘common name’ means. If anyone can point me in the right direction I would appreciate it.

P.S. One thing I noticed is that after answering the question about committing the signature it updated the data base but I get a message that says “unable to write ‘random state'”. If this means the commit actually failed and is the crux of my problem how do I correct that?

Thanks.

[Anonymous]

Although it wasn’t fun, that did get rid of the random state error. However, I still get and invalid pass phrase error and httpd won’t start.

Is there a way with an openssl command to verify the server.crt passphrase?

[Anonymous]

This is very frustrating 👿

I cannot get this to work and no matter what I try it is the same error, “Pass phrase incorrect.” There must be something very basic that I am missing that is assumed rather then explained by MacTroll’s article.

Getting desperate here. TIA.

[rcwallis]

This is very frustrating.

I have followed the steps in the article, and tried to install purchased certificates, with the same errors each time, listed below:

[Sat Mar 13 10:39:47 2004] [error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[Sat Mar 13 10:39:47 2004] [error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long

I know my passphrase is correct, I have redone the whole process at least 5 times…
I hope someone can give me a hand here, I am all out of ideas!

Thanks,

Bob

[Anonymous]

At least you are not alone. 🙂 Unfortunately, so far no one has been able to provide much assistance. I have this question on a couple of different forums but this seems to have everyone stumped. I guess there is just no decent debugging capability available that might give us some kind of direction.

[Hypnotoad]

I will add my voice to this unhappy chorus. I found apf548.com via the Apple OS X Server and macosxhints.com discussion groups, and I can report that I am having exactly the same problem. I worked through the tutorial three times, and used a very, very simple passphrase (1234) that I verified was correct in the servermgr_web_httpd_config.plist file… and the damn thing still insists that I have entered an incorrect passphrase.

Removing the passphrase works, but that sucks–it’s a security hole. grr.

[Hypnotoad]

With the the help of an apple.com discussion BBS member, I finally traced the problem to Apple’s getsslpassphrase utility… it was somehow munging the passphrase entered in the Server Admin control panel. I finally had to do this in httpd.conf:

<IfModule mod_ssl.c>
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    # Comment out Apple's buggy getsslpassphrase utility:
    # SSLPassPhraseDialog exec:/etc/httpd/getsslpassphrase
    # This will require starting the server manually (sudo apachectl start):
    SSLPassPhraseDialog builtin

This works, but from now on I will have to edit the *.conf files and start httpd manually, which sucks… what’s the point in buying $500 OS X Server if you have to drop down to the Terminal and a text editor to maintain everything anyway?! grr.

[Anonymous]

Thanks for the tip but I am still unable to get this working. Now I get an error saying it cannot find the private key. This is so frustrating. Why is this rocket science?

Helllllppppppp!!!!!!!!!!! 😥

[Anonymous]

Oops! 😳 I just realized I need to start Apache manually so please diregard the above error. The rest of the rant is valid. The error I am now getting is:

Call to undefined routine after a NSUnLinkModule with the NSUNLINKMODULE_OPTION_RESET_LAZY_REFERENCES option

[iztech]

follow this example.
it works very well and is easy to set-up.
i used a qualityssl.com cert and everything is good.

<http://www.entropy.ch:16080/software/macosx/docs/mod_ssl.html&gt;

there are instruction for options on creating a self cert and a purchased cert.

[Anonymous]

Thanks but you are a few steps behind where I am. I have the certs. The issue seems to be Apache and Apple’s specific implementation of it for SSL. There is a plethora of posts on this and they all seem to point to Apache, not the creation of certs. We already know there is a bug in Apple’s pass phrase dialog interface through the GUI so I am at the next layer of the onion.

[iztech]

that guide is not just on creating a cert. it’s on the implementation of ssl.
i have it all running.

the key is to not use the optional passphrase.

[Anonymous]

I know. I read through it and there is really nothing different from the article by MacTroll (who also said to leave the optional pass phrase out) but I’ll run through it yet again (10 times at least). What do I have to lose? 🙂

[Author]

Posts