Jump to content
Froxlor Forum
  • 0
Gamerboy59

SSL error with Apache 2.4

Question

Hi,

I|m getting the following error on enabling SSL.

 * Restarting web server apache2                                         [fail]
 * The apache2 configtest failed.
Output of config test was:
AH00526: Syntax error on line 18 of /etc/apache2/sites-enabled/10_froxlor_ipandport_12.345.67.89.80.conf:
Invalid command 'SSLEngine', perhaps misspelled or defined by a module not included in the server configuration
Action 'configtest' failed.
The Apache error log may have more information.
How to enable SSL?

Share this post


Link to post
Share on other sites

Recommended Posts

  • 0

Thanks. :)

 

I'm currently experiencing issues when adding a Domain. While using subdomians only everything works as expected but when I add a new tld an SSL-secured connection is no longer possible and the browser can't connect to the website. Unfortunately, apache is not giving any errors.

Share this post


Link to post
Share on other sites
  • 0

please re-read what Sephiroth wrote...check SERVER error-logs...not the error-message firefox gives you

Share this post


Link to post
Share on other sites
  • 0

That's what inside the apache error.log:

[Wed Oct 22 12:59:08.550531 2014] [mpm_prefork:notice] [pid 29440] AH00169: caught SIGTERM, shutting down
[Wed Oct 22 12:59:09.619527 2014] [suexec:notice] [pid 29501] AH01232: suEXEC mechanism enabled (wrapper: /usr/lib/apache2/suexec)
[Wed Oct 22 12:59:09.686132 2014] [:notice] [pid 29502] mod_python: Creating 8 session mutexes based on 150 max processes and 0 max threads.
[Wed Oct 22 12:59:09.686167 2014] [:notice] [pid 29502] mod_python: using mutex_directory /tmp 
[Wed Oct 22 12:59:09.703342 2014] [mpm_prefork:notice] [pid 29502] AH00163: Apache/2.4.7 (Ubuntu) mod_fcgid/2.3.9 PHP/5.5.9-1ubuntu4.4 mod_python/3.3.1 Python/2.7.6 OpenSSL/1.0.1f mod_perl/2.0.8 Perl/v5.18.2 configured -- resuming normal operations
[Wed Oct 22 12:59:09.703417 2014] [core:notice] [pid 29502] AH00094: Command line: '/usr/sbin/apache2'
[Wed Oct 22 13:10:03.292418 2014] [mpm_prefork:notice] [pid 29502] AH00171: Graceful restart requested, doing restart
[Wed Oct 22 13:10:06.472955 2014] [:notice] [pid 29502] mod_python: Creating 8 session mutexes based on 150 max processes and 0 max threads.
[Wed Oct 22 13:10:06.473029 2014] [:notice] [pid 29502] mod_python: using mutex_directory /tmp 
[Wed Oct 22 13:10:06.486445 2014] [mpm_prefork:notice] [pid 29502] AH00163: Apache/2.4.7 (Ubuntu) mod_fcgid/2.3.9 PHP/5.5.9-1ubuntu4.4 mod_python/3.3.1 Python/2.7.6 OpenSSL/1.0.1f mod_perl/2.0.8 Perl/v5.18.2 configured -- resuming normal operations
[Wed Oct 22 13:10:06.486487 2014] [core:notice] [pid 29502] AH00094: Command line: '/usr/sbin/apache2'
And that's the vHost config:

# 22_froxlor_ssl_vhost_my-domain_de.conf
# Created 22.10.2014 13:10
# Do NOT manually edit this file, all changes will be deleted after the next domain change at the panel.

# Domain ID: 9 (SSL) - CustomerID: 4 - CustomerLogin: mydomain
<VirtualHost 12.345.567.89:443>
  ServerName my-domain.de
  ServerAlias *.my-domain.de
  ServerAdmin email@my-domain.de
  SSLEngine On
  SSLHonorCipherOrder On
  SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
  SSLVerifyDepth 10
  SSLCertificateFile /etc/ssl/froxlor-custom/my-domain.de.crt
  SSLCertificateKeyFile /etc/ssl/froxlor-custom/my-domain.de.key
  DocumentRoot "/var/customers/webs/mydomain/"
  FcgidIdleTimeout 30
  SuexecUserGroup "mydomain" "mydomain"
  <Directory "/var/customers/webs/mydomain/">
    <FilesMatch "\.(php)$">
      SetHandler fcgid-script
      FcgidWrapper /var/www/php-fcgi-scripts/mydomain/my-domain.de/php-fcgi-starter .php
      Options +ExecCGI
    </FilesMatch>
    Require all granted
  </Directory>
  Alias /awstats "/var/customers/webs/mydomain/awstats/my-domain.de"
  Alias /awstats-icon "/usr/share/awstats/icon/"
  ErrorLog "/var/customers/logs/mydomain-error.log"
  CustomLog "/var/customers/logs/mydomain-access.log" combined
</VirtualHost>
Without SSL it works fine.

Share this post


Link to post
Share on other sites
  • 0

Could you also post your domain error log, please? And check if your key/cert match:

 

openssl x509 -noout -modulus -in /etc/ssl/froxlor-custom/my-domain.de.crt | openssl md5

openssl rsa -noout -modulus -in /etc/ssl/froxlor-custom/my-domain.de.key | openssl md5

Share this post


Link to post
Share on other sites
  • 0

We can only help you if you can provice error or debug information.

For anything else you have to contact your server administrator to debug or generate the debug output.

 

If you need someone to login to your server and debug use some managed administration services or quick help services like https://froxlor.support

Share this post


Link to post
Share on other sites
  • 0

What Output do you get from: openssl s_client -connect localhost:443 ?

 

What SSL Modul are you using? Normal SSL, or maybe gnutls?

 

Is Apache listening on 443? There could be another process which uses the https port.

Share this post


Link to post
Share on other sites
  • 0

Just by chance: Are you sure it's a server error? Did you try a different browser? For some reason Firefox has a lot of problems with SSL connections. If your site is reachable on a public IP you may also have a look at one of the various SSL test sites (ssllabs for example) which could reveal additional info if there is a certificate error.

Share this post


Link to post
Share on other sites
  • 0

openssl s_client -connect my-domain.de:443
CONNECTED(00000003)
139989321152160:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:795:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---
For localhost it works fine.

 

This is one debug message:

openssl s_client -connect my-domain:443 -state -nbio 2>&1 | grep "^SSL"
SSL_connect:before/connect initialization
SSL_connect:unknown state
SSL_connect:error in unknown state
SSL handshake has read 7 bytes and written 305 Bytes
And that's the Apache debug log:

[Fri Oct 24 20:25:06.334119 2014] [ssl:info] [pid 28048] AH01876: mod_ssl/2.4.7 compiled against Server: Apache/2.4.7, Library: OpenSSL/1.0.1f
[Fri Oct 24 20:25:06.358567 2014] [mpm_prefork:notice] [pid 28048] AH00163: Apache/2.4.7 (Ubuntu) mod_fcgid/2.3.9 PHP/5.5.9-1ubuntu4.4 mod_python/3.3.1 Python/2.7.6 OpenSSL/1.0.1f mod_perl/2.0.8 Perl/v5.18.2 configured -- resuming normal operations
[Fri Oct 24 20:25:06.358607 2014] [mpm_prefork:info] [pid 28048] AH00164: Server built: Jul 22 2014 14:36:38
[Fri Oct 24 20:25:06.358623 2014] [core:notice] [pid 28048] AH00094: Command line: '/usr/sbin/apache2'
[Fri Oct 24 20:25:06.358628 2014] [mpm_prefork:debug] [pid 28048] prefork.c(995): AH00165: Accept mutex: fcntl (default: sysvsem)
[Fri Oct 24 20:26:31.303869 2014] [core:info] [pid 28056] [client 62.226.179.39:59685] AH00566: request failed: invalid characters in URI
[Fri Oct 24 20:26:31.340447 2014] [core:info] [pid 28053] [client 62.226.179.39:59686] AH00566: request failed: invalid characters in URI
[Fri Oct 24 20:26:31.377385 2014] [core:info] [pid 28054] [client 62.226.179.39:59687] AH00566: request failed: invalid characters in URI
Edit: Maybe this is interesting too:

 

[Fri Oct 24 20:36:38.652940 2014] [ssl:debug] [pid 28253] ssl_engine_pphrase.c(181): AH02199: SSL not enabled on vhost froxlor.my-domain.de:80, skipping SSL Setup
Edit2: It looks like the SSL_Modul is not enabled for some reason...

Share this post


Link to post
Share on other sites
  • 0

SSL enabled for vhost froxlor.my-domain.de:80...

 

Port 80 is NOT for SSL....did you enable SSL for Port 80????

Share this post


Link to post
Share on other sites
  • 0

I don't think so, where to check?

 

This is my ports.conf:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

Listen 80

<IfModule ssl_module>
	Listen 443
</IfModule>

<IfModule mod_gnutls.c>
	Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Share this post


Link to post
Share on other sites
  • 0

Can you please get an admin or assign this to froxlor.support...you don't seem to know what you are doing, it's a pain to squeeze every little information out of you...

Share this post


Link to post
Share on other sites
  • 0

SSL enabled for vhost froxlor.my-domain.de:80...

 

Port 80 is NOT for SSL....did you enable SSL for Port 80????

SSL not enabled on vhost froxlor.my-domain.de:80, skipping SSL Setup

Share this post


Link to post
Share on other sites
  • 0

SSL not enabled on vhost froxlor.my-domain.de:80, skipping SSL Setup

 

AH00526: Syntax error on line 18 of /etc/apache2/sites-enabled/10_froxlor_ipandport_12.345.67.89.80.conf:

Invalid command 'SSLEngine', perhaps misspelled or defined by a module not included in the server configuration

Obviously your config tries to enable it on port 80 but fails, your initial message clearly states there are SSL-commands in the definition for port 80. As already mentioned here: SSL/TLS/HTTPs is not supposed to reside on Port 80, usually its on 443, so there is something completely off with your config. Please revert to the last known good backup, start with a fresh install or try to find someone to fix (and preferably show you how) your configuration.

 

For everyone who used the search some basic steps to enable SSL in Froxlor (if your system is already able to handle SSL):

- IPs and Ports -> Add -> Same IP as HTTP, Port 443, enable SSL-Port and supply certificate details. Additional settings according to your configuration.

- Domains -> Edit Domain -> Tick the newly created SSL-IP

Share this post


Link to post
Share on other sites
  • 0

Thanks. However, the config for port 80 doesn't include the word 'SSL', so I don't know what's going wrong there.

I tried adding SSL-support like this:

  • IPs and Ports -> Add -> Same IP as HTTP, Port 443, enable SSL-Port and supply certificate details. Additional settings according to your configuration.
  • Domains -> Edit Domain -> Tick the newly created SSL-IP
  • Customer Portal -> Domain, Setting -> SSL-Domain Settings
Edit: Maybe this is connected with the use of CGI-FCGI?

Share this post


Link to post
Share on other sites
  • 0

Ok thanks, but this goes well?
 

1. IPs and Ports -> Add -> Same IP as HTTP, Port 443, enable SSL-Port and supply certificate details. Additional settings according to your configuration.
2. Domains -> Edit Domain -> Tick the newly created SSL-IP
3. Customer Portal -> Domain, Setting -> SSL-Domain Settings

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By LukasH
      [Dieses Problem hat sich gelöst, ich hab mich doch tatsächlich verlesen, im Einsatz ist nur die .de, die .com ist nur eine Weiterleitung, klar funktioniert die nicht]
       
      ______________________________________________________________________________
       
      Dann habe ich noch ein weiteres Problem und zwar habe ich eine neue Subdomain angelegt, beim versuch ein SSL Zertifikat zu ziehen kommen nun nur die folgenden Fehlermeldungen:
      [Lets Encrypt self-check] Please check http://www.mail.hoerth.eu/.well-known/acme-challenge/_s_fIpGAblEU_T6A9Iej0RV1Wp-gte-xrTeVRu9naPI - token seems to be not available. This is just a simple self-check, it might be wrong but consider using this information when Let's Encrypt fails to issue a certificate Could not get Let's Encrypt certificate for mail.hoerth.eu: Verification ended with error: {"identifier":{"type":"dns","value":"www.mail.hoerth.eu"},"status":"invalid","expires":"2018-06-15T12:01:38Z","challenges":[{"type":"dns-01","status":"invalid","uri":"https:\/\/acme-v01.api.letsencrypt.org\/acme\/challenge\/SXa_3IeDJd19Xg3oVtLd0iaj3H2lKBN_fzM1cZPtguc\/5014287643","token":"mOYe0nDwOyTxrfZc83fmpBVeL1vZesbZrV-t_nkRdZ0"},{"type":"http-01","status":"invalid","error":{"type":"urn:acme:error:dns","detail":"DNS problem: NXDOMAIN looking up A for www.mail.hoerth.eu","status":400},"uri":"https:\/\/acme-v01.api.letsencrypt.org\/acme\/challenge\/SXa_3IeDJd19Xg3oVtLd0iaj3H2lKBN_fzM1cZPtguc\/5014287644","token":"_s_fIpGAblEU_T6A9Iej0RV1Wp-gte-xrTeVRu9naPI","keyAuthorization":"_s_fIpGAblEU_T6A9Iej0RV1Wp-gte-xrTeVRu9naPI.JriXbK73HFGeqTSIPL3Qg0VCDy2Qt0n4wrUZon9dCEM","validationRecord":[{"url":"http:\/\/www.mail.hoerth.eu\/.well-known\/acme-challenge\/_s_fIpGAblEU_T6A9Iej0RV1Wp-gte-xrTeVRu9naPI","hostname":"www.mail.hoerth.eu","port":"80"}]}],"combinations":[[0],[1]]} Ich habe dann mal nachgesehen und der Token existiert defintiv nicht - klar findet ihn Lets Encrypt also nicht, was ist denn gerade bei mir Los?
    • By jonny87
      Guten Morgen liebe Community,
      ich hab schon gesucht hier, aber nicht wirklich was passendes gefunden, darum mach ich jetzt hier nochmal nen Thread auf. Ich nutz Froxlor nun erfolgreich seit über einem Jahr auf zwei Servern, es funktioniert soweit auch alles mit LetsEncrypt und den Zertifikaten.
      Jetzt hab ich nur folgendes Problem, bzw. ist dies möglich, da ich mehrere Kunden über Froxlor auf zwei Servern verwalte, muss ich natürlich auch E-Mails verwalten, und zwar verschlüsselt. Kann man das über Froxlor machen? Sprich, dass die Kunden ihre Emails über
      imap.kunde1.de & smtp.kunde1.de sowie imap.kunde2.de & smtp.kunde2.de usw. abrufen können. 
      Momentan muss man ja bzw. so hat es mein Admin gemacht, ein Zertifikat für alle hinterlegen, welches auch nicht automatisch per Script geupdatet wird?! -> Ist das so richtig?
      Oder müssen alle Kunden ihre E-Mails per imap.hauptdomain.de abrufen? 
       
       
       
       
       
    • By Kyle Willets
      =================================================================================================================
       Package                       Arch                   Version                         Repository            Size
      =================================================================================================================
      Reinstalling:
       proftpd                       x86_64                 1.3.5e-4.el7                    epel                 3.7 M
       proftpd-mysql                 x86_64                 1.3.5e-4.el7                    epel                  50 k
      Transaction Summary
      =================================================================================================================
      Reinstall  2 Packages
      Total download size: 3.7 M
      Installed size: 9.7 M
      Is this ok [y/d/N]: y
      Downloading packages:
      (1/2): proftpd-1.3.5e-4.el7.x86_64.rpm                                                    | 3.7 MB  00:00:00
      (2/2): proftpd-mysql-1.3.5e-4.el7.x86_64.rpm                                              |  50 kB  00:00:00
      -----------------------------------------------------------------------------------------------------------------
      Total                                                                            4.0 MB/s | 3.7 MB  00:00:00
      Running transaction check
      Running transaction test
      Transaction test succeeded
      Running transaction
        Installing : proftpd-1.3.5e-4.el7.x86_64                                                                   1/2
        Installing : proftpd-mysql-1.3.5e-4.el7.x86_64                                                             2/2
        Verifying  : proftpd-mysql-1.3.5e-4.el7.x86_64                                                             1/2
        Verifying  : proftpd-1.3.5e-4.el7.x86_64                                                                   2/2
      Installed:
        proftpd.x86_64 0:1.3.5e-4.el7                        proftpd-mysql.x86_64 0:1.3.5e-4.el7
      Complete!
      [root@s128426 ~]# mv "/etc/proftpd/proftpd.conf" "/etc/proftpd/proftpd.conf.frx.bak"
      mv: cannot stat ‘/etc/proftpd/proftpd.conf’: No such file or directory
      [root@s128426 ~]# ^C
      [root@s128426 ~]# cd /etc/proftpd/
      -bash: cd: /etc/proftpd/: No such file or directory
       

      I am unable to setup ProFTP. I am using the latest version of Centos 7 and PHP 7. It says it installed, but yeah as ya can see. With the SSL it says to config something but does nto say what. So was wondering if anyone had any tips on how to get Lets Encypt working properly.
      Thank You.
    • By JuKu
      Hello everybody,
       
      I try to configure a letsencrypt certificate for one of my domains https://jukusoft.com , certificates are already generated by froxlor, but i get this error, if i browse the domain with firefox:
      SSL_ERROR_RX_RECORD_TOO_LONG
       
      If i search with google there are many threads about this topic, but there isn't any solution for this.
      Also there is no good tutorial on froxlor sites. Because i dont know if this is a bug or only a issue about a not-existent documentation, i havent created a issue on github yet.
      I also doesnt get any results by your forum search. If this is the wrong forum, please move my topic to the right! thanks!
       
      If i try to execute "openssl s_client -showcerts -connect jukusoft.com:443 -servername jukusoft.com" i get this output:
      CONNECTED(00000003) 140505437533840:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:782: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 310 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1521806504 Timeout : 300 (sec) Verify return code: 0 (ok) ---  
      I have also configured IP / Port settings:



       
      Domain Settings:

       

       
      Where is the problem?
      And please, can you write a good tutorial / documentation for SSL & letsencrypt configuration for froxlor?
    • By LukasH
      Ich hab mal wieder ein Problem bzw. einen Fehler mit unguten Auswirkungen begangen und bekomme es nicht mehr gerade gebügelt.
      Und zwar habe ich nach anfänglichem Testen mittlerweile auch mein privates Mailkonto auf einen neuen Server mit Froxlor gezogen.
      Ich hatte wie erwähnt bereits vorher einen Umzug mit Website, daher auch Datenbanken so wie Mailadressen erfolgreich durchgeführt. Der Umzug lief auch relativ glatt und auch meine privaten Mails liegen auf dem neuen Server, senden funktioniert, alle Websites sind via https erreichbar (Letsencrypt Zertifikate erfolgreich gezogen) und alles könnte eigentlich besser nicht sein. 
      Nun kann ich mich allerdings von Extern nicht mehr am smtp Server anmelden mit meiner privaten Mail-Adresse. Und zwar wollte ich in meiner noch Unwissenheit (das ist mein erstes "eigenes" Serverprojekt, meine ersten Server wurden durch andere eingerichtet und ich habe nur zugekuckt/mitgeschrieben) SSL Zertifikate für den Mailserver bekommen, Outlook hat nämlich die überaus nervige Angewohnheit bei jedem Start Zertifikatsfehlermeldungen auszugeben (bei Selbstsignierten) und auch das Speichern in den vertrauenswürdigen Zertifikatsspeicher von Windows bringt hier scheinbar keine Lösung.
      Nun dachte ich, ist ja einfach, einfach in Froxlor für jede Domain welche auch Mailadressen hat noch die Subdomain "mail.*" und "smtp.*" anlegen, LetsEncrypt anschmeißen und fertig, den Verweis stelle ich einfach auf den Ordner in welchem der Webmailer liegt. Soweit so gut, nun hat er hier allerdings keine Zertifikate gezogen sondern nur am laufenden meter PHP Errors ausgegeben. Diese hatte ich vorher immer wenn der PHP Flag für eine Domain nicht richtig gesetzt war, also mit dem admin in Froxlor eingelogt, Domain aufgerufen und gespeichert und... nichts. Gleicher Fehler. PHP Funktioniert (Webmailer wird korrekt aufgerufen) nur werden keine Zertifikate gezogen. 
      Also wollte ich erst einmal alles rückgängig machen und habe alle Subdomains (mail.* & smtp.*) wieder gelöscht. So und nun habe ich den Salat, seltsamerweise kann noch sämtliche Mailkonten von extern ansteuern, auch den jeweiligen smtp nur bei meiner privaten Mailadresse mit eigener Domain geht es nicht, auch nicht mehr bei der meiner Frau mit gleicher Domain. Outlook fragt nach den SMTP Zugangsdaten und nimmt Mailadresse + Passwort nicht, Thunderbird sagt er findet das Passwort nicht, iPhone & Android bringen ebenfalls diese Fehler. 
      ALLE anderen Domains bzw. verbundenen Mailkonten funktionieren (bis auf den Punkt mit dem Zertifikatsfehler) problemlos. Nur die meiner Hauptdomain nicht. 
      Das ganz komische ist aber, dass mein Webmailer noch ganz normal Empfangen und vor allem auch Senden kann, dieser erreicht den SMTP Server ohne Probleme und hat auch keine Login Probleme. 
      Ports sind Frei in der Windows eigenen Firewall, Ping an smtp.* geht problemlos durch, ich habe auch keinen Speedport mit vertrauenswürdiger E-Mail Liste sondern eine Fritz!Box. Bis vor 2 Stunden lief auch noch alles. Und ganz kurios ist auch, dass Outlook den smtp Server bei einer anderen Domain auf "smtpauth.*" geändert hat, Thunderbird geht allerdings via "smtp.*" ran. 
      Nun noch Screenshots von meinem Webmailer (Rainloop) und der dort voll funktionalen Konfiguration welche aber von Extern (egal ob mein Heimnetz (Unitymedia) oder Handynetz (Telekom & O2)) nicht laufen will:






×