Thanks Bernhard On Wed, Jul 30, 2014 at 12:43 PM, Bernhard Voelker wrote:

On 07/30/2014 06:02 PM, Ted Byers wrote:

...

How do I find out why apache can't bind to port 443?

E.g. "lsof -i 4tcp:443" will give you which program is listening and therefore blocking the port. (Add "-Pn" if you don't like host- and port name resolution.) Most probably httpd2? ;-)

But, when I run lsof -i 4tcp:443, I get no output at all. I would suppose that means nothing is running that is listening on 443. But, what should I change in that command to let me see what output it would produce normally? What is httpd2? Is it different than apache2? If not, it could not be running because apache2 will not start now, and if so, where did it come from and why is it there, since, for web servers, I only asked for Apache2? If I were to want another web server, it would be nginx, so I could experiment to compare the two under different loads. Thanks Ted -- R.E.(Ted) Byers, Ph.D.,Ed.D. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Jul 30, 2014 at 1:35 PM, Florian Gleixner wrote:

On 07/30/2014 07:15 PM, Ted Byers wrote:

...

But, when I run lsof -i 4tcp:443, I get no output at all.

You shoud try

lsof -i tcp:443 -s TCP:LISTEN

as root or

netstat -tulpen |grep 443

and dont be confused, if its output only contains a IPv6 listening socket. As

man ipv6

says:

"IPv4 connections can be handled with the v6 API by using the v4-mapped-on-v6 address type; thus a program only needs to support this API type to support both protocols. This is handled transparently by the address handling functions in the C library.

IPv4 and IPv6 share the local port space. When you get an IPv4 connection or packet to a IPv6 socket, its source address will be mapped to v6 and it will be mapped to v6."

Also search for multiple "Listen" lines in your Apache conf.

It turns out that this was the key to my last problem. When Googling for answers, I found examples in which there was a listen directive for each IP address on which the server could receive a request. I had posted the contents of my listen.conf file earlier, so you can see what I had done, following that advice. I commented out all the IP specific listen statements and a single statement for https, enabled only when the server is told to use SSL, and that solved the problem. Obviously the advice I found using Google was either wrong or at least outdated. Two last questions. When I submit the following: openssl s_client -connect gremlin.site:443 -showcerts I get not only the server certificate that I created from my own CA, but also the certificate that I had installed, but which was bought from GoDaddy, for one of our development servers. The latter is not mentioned in my vhosts-ssl.conf, so why is it even sent. I thought apache would send only the certificate attached to the domain in the url in the request made to the server. Also, this command gives a return value of 19, complaining that there is a self signed certificate in the certificate chain. Now, I do not know how to make such a chain to begin with, but it is almost certain that it is referring to my CA certificate (is it possible to verify this one way or another?). Now, I thought ALL CA certificates are self signed. So, what do I do to have my CA treated in the same way that all other CA certificates are treated? (I posted the steps whereby I created my CA and then the certificates for gremlin.site). Thanks Ted -- R.E.(Ted) Byers, Ph.D.,Ed.D. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Wed, Jul 30, 2014 at 2:56 PM, Ted Byers wrote:

On Wed, Jul 30, 2014 at 2:38 PM, Ted Byers wrote:

...

Two last questions. When I submit the following:

openssl s_client -connect gremlin.site:443 -showcerts

I get not only the server certificate that I created from my own CA, but also the certificate that I had installed, but which was bought from GoDaddy, for one of our development servers. The latter is not mentioned in my vhosts-ssl.conf, so why is it even sent. I thought apache would send only the certificate attached to the domain in the url in the request made to the server.

The answer to this question is that I mistook the CA root certificate for the certificate I'd made for another server. Proof I am an idiot. :-(

On further investigation, this is more troubling. None of my configuration files refer to a certificate related to my other development server. Worse, in /etc/apache2/ssl.crt and /etc/apache2/ssl.key, there exists ONLY the keys and certificates that I made when creating first my CA and then the key and certificate for gremlin.site. So, where is this other certificate located and why is Apache using it?

This just goes to show I am an idiot. I had created my rootCA.crt many months ago, and had forgotten that I created it with the FQDN of dev.profitorius.com, so all is behaving as it ought. But, I think in due course, I will regenerate the rootCA with a different FQDN (with meaning only within my LAN). But what I have will suffice for my testing purposes. Thanks all. Ted -- R.E.(Ted) Byers, Ph.D.,Ed.D. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 07/30/2014 08:48 PM, Ted Byers wrote:

The answer to this question is that I mistook the CA root certificate for the certificate I'd made for another server. Proof I am an idiot. :-(

We all take our turns sitting quietly facing the corner of the room with the tall pointy hat on from time-to-time. Glad you are wading through the 2.4 forest and seeing most of the trees. -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org