Debian Bug report logs - #773405
systemd: Systemd cannot restart apache2.service because of SSL certificate with password

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dupont Francois <francois.dupont1@etu.univ-lorraine.fr>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: systemd: Systemd cannot restart apache2.service because of SSL certificate with password

Date: Thu, 18 Dec 2014 03:25:44 +0100

[Message part 1 (text/plain, inline)]

Package: systemd
Version: 215-7
Severity: important

Dear Maintainer,


    I've created a new SSL certificate with a password for a website. 
    After properly configuring my apache configuration file, I tried to restart apache2.service (after a valid apachectl -t).
    I Could'nt do it, apache refuses to restart.
    systemd seems to not give the oportunity to enter the certificate's password  (needed for a proper apache2 restart/reload in this case).
    
    Here are the apache log that might help you understand the issue
    [Thu Dec 18 03:04:00.485817 2014] [ssl:error] [pid 11181] AH02578: Init: Unable to read pass phrase [Hint: key introduced or changed before restart?]
    [Thu Dec 18 03:04:00.485850 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
    [Thu Dec 18 03:04:00.485859 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
    [Thu Dec 18 03:04:00.485866 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
    [Thu Dec 18 03:04:00.485874 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA) 
    [Thu Dec 18 03:04:00.485881 2014] [ssl:error] [pid 11181] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
    [Thu Dec 18 03:04:00.485888 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
    [Thu Dec 18 03:04:00.485895 2014] [ssl:error] [pid 11181] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)
    [Thu Dec 18 03:04:00.485902 2014] [ssl:emerg] [pid 11181] AH02312: Fatal error initialising mod_ssl, exiting.
    [Thu Dec 18 03:04:00.485905 2014] [ssl:emerg] [pid 11181] AH02564: Failed to configure encrypted (?) private key mydomain.org:443:0, check /home/user/ssl/example.org.key
    AH00016: Configuration Failed


    Sincerly
    Francois




-- Package-specific info:

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF8, LC_CTYPE=en_US.UTF8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd depends on:
ii  acl             2.2.52-2
ii  adduser         3.113+nmu3
ii  initscripts     2.88dsf-58
ii  libacl1         2.2.52-2
ii  libaudit1       1:2.4-1+b1
ii  libblkid1       2.25.2-3
ii  libc6           2.19-13
ii  libcap2         1:2.24-6
ii  libcap2-bin     1:2.24-6
ii  libcryptsetup4  2:1.6.6-3
ii  libgcrypt20     1.6.2-4+b1
ii  libkmod2        18-3
ii  liblzma5        5.1.1alpha+20120614-2+b3
ii  libpam0g        1.1.8-3.1
ii  libselinux1     2.3-2
ii  libsystemd0     215-7
ii  mount           2.25.2-3
ii  sysv-rc         2.88dsf-58
ii  udev            215-7
ii  util-linux      2.25.2-3

Versions of packages systemd recommends:
ii  dbus            1.8.12-1
ii  libpam-systemd  215-7

Versions of packages systemd suggests:
pn  systemd-ui  <none>

-- no debconf information

[systemd-delta.txt (text/plain, attachment)]

[systemd-analyze-dump.txt (text/plain, attachment)]

[dsh-enabled.txt (text/plain, attachment)]

[fstab (text/plain, attachment)]

Message #10 received at 773405@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Dupont Francois <francois.dupont1@etu.univ-lorraine.fr>, 773405@bugs.debian.org

Subject: Re: Bug#773405: systemd: Systemd cannot restart apache2.service because of SSL certificate with password

Date: Thu, 18 Dec 2014 13:09:45 +0100

[Message part 1 (text/plain, inline)]

Am 18.12.2014 um 03:25 schrieb Dupont Francois:
> Package: systemd
> Version: 215-7
> Severity: important
> 
> Dear Maintainer,
> 
> 
>     I've created a new SSL certificate with a password for a website. 
>     After properly configuring my apache configuration file, I tried to restart apache2.service (after a valid apachectl -t).
>     I Could'nt do it, apache refuses to restart.
>     systemd seems to not give the oportunity to enter the certificate's password  (needed for a proper apache2 restart/reload in this case).
>     


I would suggest simply using a passwordless certificate.
If you insist on using a passphrase, you should try apache's
SSLPassPhraseDialog configuration directive.
This way you can eider feed the passphrase to apache statically via a
simple shell script which echo's the password string, or you use
systemd's password agent interface [2] to query for the password via the
systemd-ask-password command line tool.

Imho this is simply a configuration issue and not a bug in systemd, so
I'm inclined to close the bug report or maybe re-assign to the apache
package, so it can be added to its README.Debian (or a similar file)


[1] http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslpassphrasedialog
[2] http://www.freedesktop.org/wiki/Software/systemd/PasswordAgents/
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 773405@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Dupont Francois <francois.dupont1@etu.univ-lorraine.fr>, 773405@bugs.debian.org, apache2@packages.debian.org

Subject: Re: Bug#773405: systemd: Systemd cannot restart apache2.service because of SSL certificate with password

Date: Thu, 18 Dec 2014 13:34:45 +0100

[Message part 1 (text/plain, inline)]

Am 18.12.2014 um 13:09 schrieb Michael Biebl:
> Am 18.12.2014 um 03:25 schrieb Dupont Francois:
>> Package: systemd
>> Version: 215-7
>> Severity: important
>>
>> Dear Maintainer,
>>
>>
>>     I've created a new SSL certificate with a password for a website. 
>>     After properly configuring my apache configuration file, I tried to restart apache2.service (after a valid apachectl -t).
>>     I Could'nt do it, apache refuses to restart.
>>     systemd seems to not give the oportunity to enter the certificate's password  (needed for a proper apache2 restart/reload in this case).
>>     
> 
> 
> I would suggest simply using a passwordless certificate.
> If you insist on using a passphrase, you should try apache's
> SSLPassPhraseDialog configuration directive.
> This way you can eider feed the passphrase to apache statically via a
> simple shell script which echo's the password string, or you use
> systemd's password agent interface [2] to query for the password via the
> systemd-ask-password command line tool.
> 
> Imho this is simply a configuration issue and not a bug in systemd, so
> I'm inclined to close the bug report or maybe re-assign to the apache
> package, so it can be added to its README.Debian (or a similar file)
> 
> 
> [1] http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslpassphrasedialog
> [2] http://www.freedesktop.org/wiki/Software/systemd/PasswordAgents/
> 

Related to that:

https://bugzilla.redhat.com/show_bug.cgi?id=707917

Might be worth having a look at the httpd-ssl-pass-dialog script that is
shipped in the Fedora package.


@apache maintainers: Are you ok if we re-assign this to the apache
package and handle it there? You can keep the pkg-systemd-maintainers in
CC if there are further questions.

Michael

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

[signature.asc (application/pgp-signature, attachment)]

Message #20 received at 773405@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Michael Biebl <biebl@debian.org>

Cc: 773405@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#773405: systemd: Systemd cannot restart apache2.service because of SSL certificate with password

Date: Mon, 22 Dec 2014 16:46:13 +0100

reassign 773405 apache2
found 773405 2.4.10-8
thanks

On Thursday 18 December 2014 13:34:45, Michael Biebl wrote:
> @apache maintainers: Are you ok if we re-assign this to the apache
> package and handle it there? You can keep the
> pkg-systemd-maintainers in CC if there are further questions.

makes sense.

Cheers,
Stefan

Message #31 received at 773405-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 773405-close@bugs.debian.org

Subject: Bug#773405: fixed in apache2 2.4.10-9

Date: Mon, 22 Dec 2014 21:19:43 +0000

Source: apache2
Source-Version: 2.4.10-9

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 773405@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 22 Dec 2014 20:24:36 +0100
Source: apache2
Binary: apache2 apache2-data apache2-bin apache2-mpm-worker apache2-mpm-prefork apache2-mpm-event apache2-mpm-itk apache2.2-bin apache2.2-common libapache2-mod-proxy-html libapache2-mod-macro apache2-utils apache2-suexec apache2-suexec-pristine apache2-suexec-custom apache2-doc apache2-dev apache2-dbg
Architecture: source amd64 all
Version: 2.4.10-9
Distribution: unstable
Urgency: medium
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description:
 apache2    - Apache HTTP Server
 apache2-bin - Apache HTTP Server (modules and other binary files)
 apache2-data - Apache HTTP Server (common files)
 apache2-dbg - Apache debugging symbols
 apache2-dev - Apache HTTP Server (development headers)
 apache2-doc - Apache HTTP Server (on-site documentation)
 apache2-mpm-event - transitional event MPM package for apache2
 apache2-mpm-itk - transitional itk MPM package for apache2
 apache2-mpm-prefork - transitional prefork MPM package for apache2
 apache2-mpm-worker - transitional worker MPM package for apache2
 apache2-suexec - transitional package for apache2-suexec-pristine
 apache2-suexec-custom - Apache HTTP Server configurable suexec program for mod_suexec
 apache2-suexec-pristine - Apache HTTP Server standard suexec program for mod_suexec
 apache2-utils - Apache HTTP Server (utility programs for web servers)
 apache2.2-bin - Transitional package for apache2-bin
 apache2.2-common - Transitional package for apache2
 libapache2-mod-macro - Transitional package for apache2-bin
 libapache2-mod-proxy-html - Transitional package for apache2-bin
Closes: 770421 773405
Changes:
 apache2 (2.4.10-9) unstable; urgency=medium
 .
   * CVE-2014-8109: mod_lua: Fix handling of the Require line when a
     LuaAuthzProvider is used in multiple Require directives with different
     arguments.
   * Include ask-for-passphrase script from Ubuntu with some tweaks. This
     fixes asking for certificate passphrases if started via systemd.
     Closes: #773405
   * Fix init script to not wait 20s if passphrase was wrong.
   * Also bump debhelper build-depends to get dh_installdeb with support for
     symlink_to_dir. Closes: #770421
Checksums-Sha1:
 68375c2bcf94793561feb481bc7eba6b4c303760 3223 apache2_2.4.10-9.dsc
 e55abd44f118fde02310a34c216769b356e4c7be 527232 apache2_2.4.10-9.debian.tar.xz
 e6e172f6b454a2c28a8a8bb073d46caa3ebb2431 1150 libapache2-mod-proxy-html_2.4.10-9_amd64.deb
 c9b2c049dae66496def476c2a6d7ecda8f3058c5 1138 libapache2-mod-macro_2.4.10-9_amd64.deb
 38523698183e3ecf409b7101970af04958aa032f 204760 apache2_2.4.10-9_amd64.deb
 be0aea896a7a9b5517263bc2d017cfa704918a13 162580 apache2-data_2.4.10-9_all.deb
 697339b3787a32ddb8d5d1984f90578a8d6e537f 1031020 apache2-bin_2.4.10-9_amd64.deb
 a1e45a431b90358b77f7e69ff568efcd10dd4a09 1512 apache2-mpm-worker_2.4.10-9_amd64.deb
 91ed55a24be6455dc9b685c210f852d11792d751 1514 apache2-mpm-prefork_2.4.10-9_amd64.deb
 3e853a8d9846200b6a96799782796a769e79cb7a 1514 apache2-mpm-event_2.4.10-9_amd64.deb
 4b07fbab6b5dd553440407150999e35ae92b9928 1514 apache2-mpm-itk_2.4.10-9_amd64.deb
 2523fc772991b7c0de7851cd24a2d5606b5c1e7e 1696 apache2.2-bin_2.4.10-9_amd64.deb
 f2943281ab8f752bfc60df0ff590816412dc277e 123710 apache2.2-common_2.4.10-9_amd64.deb
 068eae014b69edc77f1a9266979c7fabc7b546a6 194010 apache2-utils_2.4.10-9_amd64.deb
 e78f8c5ba9871c54ac02efbcf1985a2699cd4b75 1658 apache2-suexec_2.4.10-9_amd64.deb
 a4d12be0a2638c9ac3a9dee9d773d588f04f7455 128896 apache2-suexec-pristine_2.4.10-9_amd64.deb
 01c8edb62ef7bfca2b631887f67d60e662749880 130410 apache2-suexec-custom_2.4.10-9_amd64.deb
 a4dda458643911f0afe193277ad311d9121dedb1 2725198 apache2-doc_2.4.10-9_all.deb
 ef4730f44db1534b9daa44f5a0c2d21d9ced7632 279964 apache2-dev_2.4.10-9_amd64.deb
 d2ac1becc215c7cde139f482bfd5a998035c75cd 1704898 apache2-dbg_2.4.10-9_amd64.deb
Checksums-Sha256:
 e6b9236ff21d6ac5953a755d497f69fa6c82b4eff89a16bcf85070ce40c13d69 3223 apache2_2.4.10-9.dsc
 5163845d04b24e5b5ec12cacc15c35aec410e22acc158ebc5538767001e244a0 527232 apache2_2.4.10-9.debian.tar.xz
 aeaa0ef045e11600ddcc8da1a1ad30d45bae3c016d95f5e8a79d8cbc3bdb1a83 1150 libapache2-mod-proxy-html_2.4.10-9_amd64.deb
 4250e4a1c76bfff4994d2fa6ba818bb131097ab3542c56a417e3c29958eaeb56 1138 libapache2-mod-macro_2.4.10-9_amd64.deb
 92930a54f9c70068a31b2ac6b3bfae2f5ee1b47d5b1881f3a63c1d912e6e1801 204760 apache2_2.4.10-9_amd64.deb
 b4737cb8848a5ea74dd90c0de5cee5d1c0203323731f104f19730f10081155ed 162580 apache2-data_2.4.10-9_all.deb
 f1f36606f4a687a5c44d68bf6bc6f869979bb3bccb7c6fb772e6953cedfcd867 1031020 apache2-bin_2.4.10-9_amd64.deb
 c8034cf0829f54e38625016713f38989e184e3c066eef1d676e450d3141a5cf9 1512 apache2-mpm-worker_2.4.10-9_amd64.deb
 052bf5481d696cd9808d3de6ca6ca826bdad9d2989bfeb9a44ae7405bdd2e9ba 1514 apache2-mpm-prefork_2.4.10-9_amd64.deb
 f5bc8b8f32bf4300d47ec7dfa05fc650131d19911f61bcd598b57b9953041d33 1514 apache2-mpm-event_2.4.10-9_amd64.deb
 fc5ce811bbd65e2296436b9e426bd5fe95b751328954b589bdc7779c6348c271 1514 apache2-mpm-itk_2.4.10-9_amd64.deb
 f9cd24fd94a61d3718fb33eeb79ce7f712505d9254d27261ce475e503eec4dae 1696 apache2.2-bin_2.4.10-9_amd64.deb
 bd00dc4f79e18e9ef92d7f1e09e77b6fdcfd621edb5049e888fe66d02f1b5633 123710 apache2.2-common_2.4.10-9_amd64.deb
 c5df35e3d7d4d8502061803c447a8647542fc94f74ea59cc72da37efd36572b0 194010 apache2-utils_2.4.10-9_amd64.deb
 9cffeb1d89989f02317efd573a8be957d72894c14ce94518631965fc10af6e1e 1658 apache2-suexec_2.4.10-9_amd64.deb
 7c411d688af6d9045a308d92a4a4b1640dd6cdf1fe0e4e595011f28c490f71f9 128896 apache2-suexec-pristine_2.4.10-9_amd64.deb
 4b8a61b701d8df630d74f502eff631c6e911b91cdb1b7c4bddd7b5d595d91359 130410 apache2-suexec-custom_2.4.10-9_amd64.deb
 392e285583ff0317af650512a333586b903ae41a80b2ee7e3d36587a973363e9 2725198 apache2-doc_2.4.10-9_all.deb
 083ec47eb9e2052c31f10c6f5f91bf0a955d22b1817fa34732090cb505292be5 279964 apache2-dev_2.4.10-9_amd64.deb
 43ebbac553b8cdc12c324d933719594d5f0a1a76b4750510678f62642b4d5f18 1704898 apache2-dbg_2.4.10-9_amd64.deb
Files:
 dd5e15782983d3b4abc4e2911296a148 3223 httpd optional apache2_2.4.10-9.dsc
 e5219d925a3c990a1a39070f9dca097a 527232 httpd optional apache2_2.4.10-9.debian.tar.xz
 1812db3d8b323dd876a645ca888da741 1150 oldlibs extra libapache2-mod-proxy-html_2.4.10-9_amd64.deb
 80c84ba609d0f8d56b3dfe8e49eeb048 1138 oldlibs extra libapache2-mod-macro_2.4.10-9_amd64.deb
 f8d29f7b02e973df66cdc4ad7a6ccfaf 204760 httpd optional apache2_2.4.10-9_amd64.deb
 a9bf64c9fd7a78009229b5b60300af15 162580 httpd optional apache2-data_2.4.10-9_all.deb
 c79f3085df15722b93bec5cf43f6e1a0 1031020 httpd optional apache2-bin_2.4.10-9_amd64.deb
 e87a66ebd7973f50df5ad1b98709c051 1512 oldlibs extra apache2-mpm-worker_2.4.10-9_amd64.deb
 de22d969820bed44582285c539efd992 1514 oldlibs extra apache2-mpm-prefork_2.4.10-9_amd64.deb
 65655b0986512142b77683d50eed8760 1514 oldlibs extra apache2-mpm-event_2.4.10-9_amd64.deb
 1b31d7867bf72889db27954ba0a0c456 1514 oldlibs extra apache2-mpm-itk_2.4.10-9_amd64.deb
 c98ee185769cd1295c2914e7fb9506cc 1696 oldlibs extra apache2.2-bin_2.4.10-9_amd64.deb
 a2206cf17961c5c468d42cddc394b0c5 123710 oldlibs extra apache2.2-common_2.4.10-9_amd64.deb
 b8d30a267913e1739bdf193ed72c5da0 194010 httpd optional apache2-utils_2.4.10-9_amd64.deb
 a39db0995b7afc2763110b5caf7dd17d 1658 oldlibs extra apache2-suexec_2.4.10-9_amd64.deb
 ef107d99403a0beadfb98e557a7ccfd7 128896 httpd optional apache2-suexec-pristine_2.4.10-9_amd64.deb
 144032f19a3e1f3a6b58034aed00e7c4 130410 httpd extra apache2-suexec-custom_2.4.10-9_amd64.deb
 f333d5bd7ac5d79866fc102e1f189cda 2725198 doc optional apache2-doc_2.4.10-9_all.deb
 5c931f71d8eaa093b8944429fc43d30a 279964 httpd optional apache2-dev_2.4.10-9_amd64.deb
 533ea2a4cb609d1e6cd4c0017d5952ff 1704898 debug extra apache2-dbg_2.4.10-9_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBVJiFCsaHXzVBzv3gAQg4ag/+JT4Wxn7Ji7cZl2c/PSJgMP8EZGC6XAjw
IW0zzoNjTAUjjIpsysm16cfL8VZoMPL99FFlPRsAOyJEETNY83ECI6GYeOrHoHLk
0UB2Ud08k5XYyhINfUnoxn8G0sRCh7GVeOytY08SZIjE7vOS1i7fr1emu4q2lEjN
e9UVYZbP0+EjA75BThGv2CVMDwt+vbvgHZaPo7Jj7kITyuc/SCS08ghWGNKEqpVS
v7BV2MMbtZvVp6OEDtqBIUmyz9XpFIrlIOzyTIiVNJ+32gpfV37ixILt+3gcT7lj
SLjIlzJAIXxeDM5uEjhdGERzPPDgCOOJhMNWgM+avFLcvegNxMiS8Ex2DmFPLeXN
jlNFKWl+wD7AEJtfbUMcGi4cqfb45qGzmcaxb6zwMwMI76WZvNxPrkL8a+RrKQRh
BrpyeLLZtHxyPqn83n65f5NDVHTDZIDcyW/PAn53sCXtOne4Twedq92yq/tdd84b
ZURVJdCoDdh6Dap6hJSIOgPHbslsUcc3Bi0NzEpBKQWloA0inYw8aD1hhT9nbP51
N6i8kkLmvXCpWl5cVaX5tZGeo/tMI4RWUh16lgBUENk/VUlYECPL2ohCiygAqVYU
FUd0EV3ogEF/rIMOq4bTsy0Vm0MlumY1mRagM5ndcMFnB9G/hBopsT8iHBYU+UBH
ZGtBh6GtS8M=
=kvcq
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.