SSL Problems. . .

[Anonymous]

Not surprisingly, to me, I still get the same error. 😥

[Anonymous]

I was getting the same set of errors on trying to start up with the web server with SSL enabled:

[Thu Sep 30 13:33:36 2004] [error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[Thu Sep 30 13:33:36 2004] [error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long

However, MacTroll’s advice worked for me. I took the contents of the “serverno.key” file that I had generated during his SSL article, and put that in the “Key File” for the site, in Server Admin. Now Apache starts up fine.

Although for some reason, it will only let me access the site as https://my.domain.com:16433 instead of just https://my.domain.com . That’s probably an unrelated issue, though.

[Anonymous]

Hey all,

After working on this same issue for a couple days, I finally ran across a forum mentioning to turn off the “Performance Cache” feature. Once I did this the web services started right up with SSL enabled.

[msmonroe]

This is exactly what we were experiencing ( the Pass phrase incorrect message etc. ) After I unchecked the “Performance Cache” option, I was able to get the web service to start up. Good Call!

[Detrius]

I just want to add a few details here. I created an SSL key WITH a password. My web server is actually working. Also, the LDAP server works, but needs to be started manually: sudo /usr/libexec/slapd –it requests the password and then works properly.

However, I don’t think there’s much benefit to having the password, so I may recreate the keys.

To those wondering:
Certificate file is newcert.pem
Key file is newreq.pem
CA file is demoCA/cacert.pem

I followed Apple’s directions: http://developer.apple.com/server/security_ssl.html

[gw1500se]

Has anyone come up with a reliable way to implement this yet? Apple is still claiming there is no problem (with the instructions in the admin manual) but I sure can’t get anything to work and I’ve tried every methodology suggested. Apple disputes the claim that something is wrong with ‘getsslpassphrase’.

P.S. The last one from developer.apple.com doesn’t work either because:

1) The directory for for the Keychain does not exist.
2) Even if I create the directory, ‘certtool’ gets the error “Error getting keychain handle.”

[Detrius]

The keychain issue only affects e-mail–not web or open directory–but I also couldn’t get that part to work; I didn’t try too hard though, as I’m the only person using these servers.

[Anonymous]

I had the following errors running SSL for Apache on Panther (10.3.6 server):

[error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long

I had to do two things to solve the problem in the site config for the SSL domain:
1. turn off Options->Performance Cache
2. enter a domain name in General ->Domain Name.

I don’t know why (1) is important, but (2) makes perfect sense now that I think about it — for SSL I had made an exact copy of the default settings and changed only the port (from 80 to 443). But this leaves General->Domain Name blank, and an SSL cert is tied to a specific domain. Ahhh, hindsight: the smack on the forehead after the kick in the pants.

zak.

[Anonymous]

I was having the same problem. I turned off the performance caching and now it works. That is a lovely little detail don’t you think. 3 days trying and 15 hours of surfing to find the answer.

[Anonymous]

Ok, how do I uncheck the “Performance Cache” option? Where do I find it?

Thanks in advance!

[Anonymous]

I encountered this problem and burned six hours on it
(including two calls to Apple support and one email to GeoTrust)
before reading this forum and finding the solution.

The moment I changed the port number in General from
80 to 443, it started working. (I already had the performance
cache turned off (the Apple support guy suggested that)).

Anyway, thanks for posting the solution.

[Anonymous]

gw1500se wrote:

Has anyone come up with a reliable way to implement this yet? Apple is still claiming there is no problem (with the instructions in the admin manual) but I sure can’t get anything to work and I’ve tried every methodology suggested. Apple disputes the claim that something is wrong with ‘getsslpassphrase’.

P.S. The last one from developer.apple.com doesn’t work either because:

1) The directory for for the Keychain does not exist.
2) Even if I create the directory, ‘certtool’ gets the error “Error getting keychain handle.”

On the http://developer.apple.com/server/security_ssl.html there is a mistake when it tells you to use the certtool c k=……./certkc when you get to this point just type in certtool c and it will prompt you for the rest. the k= option does not work. Took me some time to figure it out.

[Anonymous]

MB wrote:

gw1500se wrote:

Has anyone come up with a reliable way to implement this yet? Apple is still claiming there is no problem (with the instructions in the admin manual) but I sure can’t get anything to work and I’ve tried every methodology suggested. Apple disputes the claim that something is wrong with ‘getsslpassphrase’.

P.S. The last one from developer.apple.com doesn’t work either because:

1) The directory for for the Keychain does not exist.
2) Even if I create the directory, ‘certtool’ gets the error “Error getting keychain handle.”

On the http://developer.apple.com/server/security_ssl.html there is a mistake when it tells you to use the certtool c k=……./certkc when you get to this point just type in certtool c and it will prompt you for the rest. the k= option does not work. Took me some time to figure it out.

Oh And the Name of the certkey must match your ME card in address book so either rename it in your address book or use the System Administrator for the name.

[mrogerson]

Zak Burke wrote:

I had the following errors running SSL for Apache on Panther (10.3.6 server):

[error] mod_ssl: Init: Pass phrase incorrect (OpenSSL library error follows)
[error] OpenSSL: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long

I had to do two things to solve the problem in the site config for the SSL domain:
1. turn off Options->Performance Cache
2. enter a domain name in General ->Domain Name.

I don’t know why (1) is important, but (2) makes perfect sense now that I think about it — for SSL I had made an exact copy of the default settings and changed only the port (from 80 to 443). But this leaves General->Domain Name blank, and an SSL cert is tied to a specific domain. Ahhh, hindsight: the smack on the forehead after the kick in the pants.

zak.

I too had wasted half a day reentering the same passphrase and certificate info, until I saw your reply, and it was the lack of a domain name that had been causing all the problems.

Luckily, Apple document this in the user guide – Well one day maybe…

Thanks Zak

[Author]

Posts