Debian Bug report logs - #794383
apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Felicitus <felicitus@felicitus.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Sun, 02 Aug 2015 14:14:11 +0200

Package: apache2.2-common
Version: 2.2.22-13+deb7u5
Severity: important

Dear Maintainer,

I today upraded to 2.2.22-13+deb7u5. After the upgrade, I noticed that
apache2 wouldn't start up anymore. After examining the log files, I
found this line:

[Sun Aug 02 13:19:52 2015] [error] Failed to configure CA certificate chain!

My configuration (which hasn't changed since 2.2.22-13+deb7u4) looks
like this:

SSLEngine on
SSLCertificateFile /etc/ssl/certs/wildcard.felicitus.org.crt
SSLCertificateChainFile /etc/ssl/certs/sub.class2.server.sha2.ca.pem
SSLCertificateKeyFile /etc/ssl/private/wildcard.felicitus.org.key

When downgrading to 2.2.22-13+deb7u4, the web server can be started again.

-- Package-specific info:
List of enabled modules from 'apache2 -M':
  alias auth_basic authn_file authz_default authz_groupfile
  authz_host authz_user autoindex cgi deflate dir env mime
  negotiation php5 proxy_http proxy reqtimeout rewrite setenvif ssl
  status
List of enabled php5 extensions:
  apc curl gd geoip imagick mysql mysqli pdo pdo_mysql xsl

-- System Information:
Debian Release: 7.8
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/3 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages apache2 depends on:
ii  apache2-mpm-itk   2.2.22-13+deb7u4
ii  apache2.2-common  2.2.22-13+deb7u4

apache2 recommends no packages.

apache2 suggests no packages.

Versions of packages apache2.2-common depends on:
ii  apache2-utils  2.2.22-13+deb7u5
ii  apache2.2-bin  2.2.22-13+deb7u4
ii  lsb-base       4.1+Debian8+deb7u1
ii  mime-support   3.52-1+deb7u1
ii  perl           5.14.2-21+deb7u2
ii  procps         1:3.3.3-3

Versions of packages apache2.2-common recommends:
ii  ssl-cert  1.0.32

Versions of packages apache2.2-common suggests:
pn  apache2-doc                             <none>
pn  apache2-suexec | apache2-suexec-custom  <none>
ii  w3m [www-browser]                       0.5.3-8

-- no debconf information

Message #10 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Takatsugu Nokubi <nokubi@gmail.com>

To: 794383@bugs.debian.org

Subject: Re: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Mon, 3 Aug 2015 13:35:09 +0900

I have same problem.
I tried to downgrade old (deb7u4) package and check again, it works fine.

Currentry disabling SSLCertificateChainFile is a workaround, but
it causes failing SSL certificate verify process.

Message #15 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Felicitus <felicitus@felicitus.org>, Takatsugu Nokubi <nokubi@gmail.com>

Cc: 794383@bugs.debian.org

Subject: Re: Bug#794383: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Fri, 07 Aug 2015 23:18:26 +0200

[Message part 1 (text/plain, inline)]

Hi,

On Sunday 02 August 2015 14:14:11, Felicitus wrote:
> [Sun Aug 02 13:19:52 2015] [error] Failed to configure CA
> certificate chain!

Please try the version from https://people.debian.org/~sf/794383/ 
and check if it either fixes the problem or at least gives some 
more information in the error log. You may either replace all 
packages with dpkg or only the /usr/lib/apache2/modules/mod_ssl.so 
file by hand.

The sha256 sums are below.

Thanks in advance.

Cheers,
Stefan

e9c380349cc6828e3eacc4cae61950bab89f85d39ccef7fd2930052014e917ec  apache2_2.2.22-13+deb7u5+sf1_amd64.changes
5e6d002832a4d84bdcda5189acad7696b76a08505a1d2fb93e0531c0f78db435  apache2_2.2.22-13+deb7u5+sf1_amd64.deb
b6c281ae8a89d94148e131493cca5db21a76734ca8801528d2e491a27e99e76c  apache2_2.2.22-13+deb7u5+sf1.debian.tar.xz
2a2ff9d027749ecbc5fa7d0c113edc126c87c03e7ffe01f2a0a75672d986a93e  apache2_2.2.22-13+deb7u5+sf1.dsc
74c1ffffefe1a502339b004ad6488fbd858eb425a05968cd67c05695dbc0fe7c  apache2_2.2.22.orig.tar.gz
2894f0f911db55cb39db46537020b17013c0f66a58a52d788699c65002ac58bd  apache2.2-bin_2.2.22-13+deb7u5+sf1_amd64.deb
5ab19208f949bc5897c7b6e5f3115bae3083f2dc91d4149783e164de23ff13d1  apache2.2-common_2.2.22-13+deb7u5+sf1_amd64.deb
ee019865f50f5b39db85da152316aa8a3f636321f52b01b66b4b99ff3508e510  apache2-dbg_2.2.22-13+deb7u5+sf1_amd64.deb
1aacf94ba56b86484dc1eb593ba3425880555e83448ed9f2a6e6a0568c8424f2  apache2-doc_2.2.22-13+deb7u5+sf1_all.deb
2de2b0ac2cd21b98b13703cacdd6ed44bb7758aeeecf7d6194e0197fc717c3ac  apache2-mpm-event_2.2.22-13+deb7u5+sf1_amd64.deb
e26b9a4bffebe7151535da515691a141b6930a2672b8fe5d640f6d0988ee7218  apache2-mpm-itk_2.2.22-13+deb7u5+sf1_amd64.deb
fd8216542a06af4461ae42c58736c2a97dc9f211b91477da12d196c64a0854a6  apache2-mpm-prefork_2.2.22-13+deb7u5+sf1_amd64.deb
ad986acc97024990ee5a2d70a5fb7fb421682499d553b9bd18836edfdf8ed8b0  apache2-mpm-worker_2.2.22-13+deb7u5+sf1_amd64.deb
d0e01faaa22614bc4a794568531036a53af77128ddc7063576560a3fb0ddbaf6  apache2-prefork-dev_2.2.22-13+deb7u5+sf1_amd64.deb
9c023cd686801ed9d5c53008514fd6a29188a5adb182faeaa07362aac5e7172f  apache2-suexec_2.2.22-13+deb7u5+sf1_amd64.deb
e9b1994182a6fe07ae975757875281a7278bcf272eeff98eaa3138cb0207a7b7  apache2-suexec-custom_2.2.22-13+deb7u5+sf1_amd64.deb
5feb8f4fcd5c923a4c89467d22483403eb341f46c15fa090ad5c428978c554e6  apache2-threaded-dev_2.2.22-13+deb7u5+sf1_amd64.deb
d8b5d69947a2f3ac7a38400dd9b6418b0adf64d6bf91b23f7c379a919fc93418  apache2-utils_2.2.22-13+deb7u5+sf1_amd64.deb
ff52cfb9f762ef33b8a7831b61070b08b7140a784be6950ab73561237419007d  mod_ssl.so

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Felicitus <felicitus@felicitus.org>

To: Stefan Fritsch <sf@sfritsch.de>, Takatsugu Nokubi <nokubi@gmail.com>

Cc: 794383@bugs.debian.org

Subject: Re: Bug#794383: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Sat, 08 Aug 2015 00:25:37 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Please try the version from https://people.debian.org/~sf/794383/ 
> and check if it either fixes the problem or at least gives some 
> more information in the error log. You may either replace all 
> packages with dpkg or only the /usr/lib/apache2/modules/mod_ssl.so
>  file by hand.

I will try that after my holiday. Note that there were _no_ additional
log entries.

cheers
Felicitus

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJVxTBhAAoJEFfhxMvO1P2NcKsIAI9RwTQT3wwLmKq+fL5ehRn6
UwACgbHq042QyclbULj/u1NmH2RtZ60+HOstE1Cbh5Znox7JhW4ZJMGETHnYxyc8
SkNwFhH9nXHaXoQ2J8r5c20TYUHYtHvJ0T0u4iL7alDmkxdmlhnwHvwMnIBzRdwJ
Cew3Z3W3ZR+oLDBtO39PhIv3yHt8VEqIfTtF/WWja4sd5223aa97TrRWirs1pWKA
8xXFsy60KCjO4eRpsoaOTnc8j/70avGJU+x6VxI2KGujGEX2UBlNGKKBlTaITW6P
g67emr6MQ9b1lt4/i5Gvx5FX9+DhIAk6bYp6aZXuf3OKoIIoZ2AFj3GZnkt7g3s=
=YOiJ
-----END PGP SIGNATURE-----

Message #25 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Felicitus <felicitus@felicitus.org>, 794383@bugs.debian.org

Subject: Re: Bug#794383: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Sat, 08 Aug 2015 22:37:38 +0200

On Saturday 08 August 2015 00:25:37, Felicitus wrote:
> > Please try the version from https://people.debian.org/~sf/794383/
> > and check if it either fixes the problem or at least gives some
> > more information in the error log. You may either replace all
> > packages with dpkg or only the /usr/lib/apache2/modules/mod_ssl.so
> > 
> >  file by hand.
> 
> I will try that after my holiday. Note that there were _no_
> additional log entries.

I know. I have added one more log message. Maybe it will help.

Message #30 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Takatsugu Nokubi <nokubi@gmail.com>

To: Stefan Fritsch <sf@sfritsch.de>

Cc: Felicitus <felicitus@felicitus.org>, 794383@bugs.debian.org

Subject: Re: Bug#794383: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Tue, 18 Aug 2015 16:07:49 +0900

Sorry fo late reply.

I tried it with rebuilded deb because I use i386 arch.
So it seems to work fine.
I don't need to replace mod_ssl.so in my situation.

2015-08-08 6:18 GMT+09:00 Stefan Fritsch <sf@sfritsch.de>:
> Please try the version from https://people.debian.org/~sf/794383/
> and check if it either fixes the problem or at least gives some
> more information in the error log. You may either replace all
> packages with dpkg or only the /usr/lib/apache2/modules/mod_ssl.so
> file by hand.

Message #35 received at 794383@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: knok@daionet.gr.jp

Cc: 794383@bugs.debian.org

Subject: Re: Bug#794383: apache2: Upgrade to apache2-2.2.22-13+deb7u5 breaks CA certificate chain

Date: Tue, 18 Aug 2015 09:46:27 +0200 (CEST)

On Tue, 18 Aug 2015, Takatsugu Nokubi wrote:

> Sorry fo late reply.
> 
> I tried it with rebuilded deb because I use i386 arch.
> So it seems to work fine.

Thanks for the testing

Stefan

Message #40 received at 794383-close@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@debian.org>

To: 794383-close@bugs.debian.org

Subject: Bug#794383: fixed in apache2 2.2.22-13+deb7u6

Date: Wed, 19 Aug 2015 18:17:44 +0000

Source: apache2
Source-Version: 2.2.22-13+deb7u6

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 794383@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefan Fritsch <sf@debian.org> (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 18 Aug 2015 11:41:11 +0200
Source: apache2
Binary: apache2.2-common apache2.2-bin apache2-mpm-worker apache2-mpm-prefork apache2-mpm-event apache2-mpm-itk apache2-utils apache2-suexec apache2-suexec-custom apache2 apache2-doc apache2-prefork-dev apache2-threaded-dev apache2-dbg
Architecture: source amd64 all
Version: 2.2.22-13+deb7u6
Distribution: wheezy-security
Urgency: medium
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Stefan Fritsch <sf@debian.org>
Description: 
 apache2    - Apache HTTP Server metapackage
 apache2-dbg - Apache debugging symbols
 apache2-doc - Apache HTTP Server documentation
 apache2-mpm-event - Apache HTTP Server - event driven model
 apache2-mpm-itk - multiuser MPM for Apache 2.2
 apache2-mpm-prefork - Apache HTTP Server - traditional non-threaded model
 apache2-mpm-worker - Apache HTTP Server - high speed threaded model
 apache2-prefork-dev - Apache development headers - non-threaded MPM
 apache2-suexec - Standard suexec program for Apache 2 mod_suexec
 apache2-suexec-custom - Configurable suexec program for Apache 2 mod_suexec
 apache2-threaded-dev - Apache development headers - threaded MPM
 apache2-utils - utility programs for webservers
 apache2.2-bin - Apache HTTP Server common binary files
 apache2.2-common - Apache HTTP Server common files
Closes: 794383
Changes: 
 apache2 (2.2.22-13+deb7u6) wheezy-security; urgency=medium
 .
   * Fix regression causing spurious errors when loading certificate chain.
     Closes: #794383
Checksums-Sha1: 
 bb4b7c7f2adfcc62e8a6fac037a1d2e05f576ce7 2899 apache2_2.2.22-13+deb7u6.dsc
 0c30dbefd39eb62a0e7ff4fcca8e419ea605a772 237222 apache2_2.2.22-13+deb7u6.debian.tar.gz
 80737048939e003ba4146b488d647a9f1cb49a93 293730 apache2.2-common_2.2.22-13+deb7u6_amd64.deb
 71c5d793045ef19fbed8579437f7e16795e14920 793390 apache2.2-bin_2.2.22-13+deb7u6_amd64.deb
 e44daaf5b605ea426a9b4548cc72f7aebf002063 2236 apache2-mpm-worker_2.2.22-13+deb7u6_amd64.deb
 8f00b64455e5eea7ba3c584455bef5b6ce746b71 2354 apache2-mpm-prefork_2.2.22-13+deb7u6_amd64.deb
 7f318dc2fd812573559cc957363cf48f8c829830 2302 apache2-mpm-event_2.2.22-13+deb7u6_amd64.deb
 3225585712f5185c00ad2b85a1df7ef47933a25a 2336 apache2-mpm-itk_2.2.22-13+deb7u6_amd64.deb
 ba16c7c52ac3a8b9eca1c497a8f7e1c912e43621 163630 apache2-utils_2.2.22-13+deb7u6_amd64.deb
 fc3d8a2b54de7bc1c2a0164fd1a3872824015d8a 107208 apache2-suexec_2.2.22-13+deb7u6_amd64.deb
 adea3d128772627cea24571f4bb003c87478f55f 108714 apache2-suexec-custom_2.2.22-13+deb7u6_amd64.deb
 36969604aaa823a7f095eb2877c94b88cd4e9778 1438 apache2_2.2.22-13+deb7u6_amd64.deb
 e3423998f460ca3ac1ab24cf49e1958ffb6fdaa5 1776854 apache2-doc_2.2.22-13+deb7u6_all.deb
 824bbed3b1b9a87c85605be6f1e5dabf732f1a4a 114642 apache2-prefork-dev_2.2.22-13+deb7u6_amd64.deb
 3209590f68b1cd997fdc5372ee6a773b02c714d6 115446 apache2-threaded-dev_2.2.22-13+deb7u6_amd64.deb
 c7ccaab1a6020318648b32ddaa468cb20ac5fef7 1726524 apache2-dbg_2.2.22-13+deb7u6_amd64.deb
Checksums-Sha256: 
 b21891654d9332c5d359fb612613cb12fdac3597822c03acb7e2b9bd01b51757 2899 apache2_2.2.22-13+deb7u6.dsc
 0264cfe54bee4e1534d38d11a8d09e7f9ce0084a841496957c1aa219e0a6ff5d 237222 apache2_2.2.22-13+deb7u6.debian.tar.gz
 27729419bf59990d2477948f50c2d14496679d67158249af47c0f22e26eb766f 293730 apache2.2-common_2.2.22-13+deb7u6_amd64.deb
 3a1185438e495dd1af868929405923ba3a30a083cafa56bf0693d5ee80c58206 793390 apache2.2-bin_2.2.22-13+deb7u6_amd64.deb
 98dafe902a89517f46b93d1d22f6f84dfbd44e04f04dd4a6702fcbf7cf623224 2236 apache2-mpm-worker_2.2.22-13+deb7u6_amd64.deb
 f7cc52a6a7206093ce702c46e7dc3dfffe3adc2bce18cb9544528549764bcb34 2354 apache2-mpm-prefork_2.2.22-13+deb7u6_amd64.deb
 6facf5850b48c79138800294ce26ba70c72c21910c99841b3e17d7f815870ae2 2302 apache2-mpm-event_2.2.22-13+deb7u6_amd64.deb
 f172b002861b5dddc8ea0f38a97dfd6a01afcd9bbf7abeaebe8dc76cd229ba52 2336 apache2-mpm-itk_2.2.22-13+deb7u6_amd64.deb
 7cc55f7c0c1b8e430931248cf35e7d89f320ac0079862ceb80e5d5aed90787b7 163630 apache2-utils_2.2.22-13+deb7u6_amd64.deb
 07629c055d8f6c40001493314db8c999100ac45693b539d9312ac2dc15dc2884 107208 apache2-suexec_2.2.22-13+deb7u6_amd64.deb
 f05b48447d0ee8bb2b6f5bdc7711dea9f0b381dcba59cfce0998b75ac9b1c273 108714 apache2-suexec-custom_2.2.22-13+deb7u6_amd64.deb
 d0d8a343d83955c37a759e991eb8433596e7c23445dede3c56db52489bcfbf2f 1438 apache2_2.2.22-13+deb7u6_amd64.deb
 7f7b9b7a1b008ea300ff5dc1545bdeea805cf6c168af2084399410a09357c084 1776854 apache2-doc_2.2.22-13+deb7u6_all.deb
 dd55461ed481af3cb573781c69a561e601f1d5ea5b23ed54d907412126f7c107 114642 apache2-prefork-dev_2.2.22-13+deb7u6_amd64.deb
 5c404e31a5f14108f0554f33060ea056214c418c8fbc674a3cf02e2e553154f4 115446 apache2-threaded-dev_2.2.22-13+deb7u6_amd64.deb
 e66b681257b3bbcd56d4ff9e5d371dc2938b3113f6cbd2d12ede0959a8c88969 1726524 apache2-dbg_2.2.22-13+deb7u6_amd64.deb
Files: 
 cf0306bcdef41e72696ed84f47806d8b 2899 httpd optional apache2_2.2.22-13+deb7u6.dsc
 1bb6cca0d3b4941c19fe4f885aa88e18 237222 httpd optional apache2_2.2.22-13+deb7u6.debian.tar.gz
 d0b17b1e95fe120d502d62386d48177c 293730 httpd optional apache2.2-common_2.2.22-13+deb7u6_amd64.deb
 59f2777c308ab545281ea9d1f55ee2f7 793390 httpd optional apache2.2-bin_2.2.22-13+deb7u6_amd64.deb
 a5d9052dec99e0bd31048c0ade271c49 2236 httpd optional apache2-mpm-worker_2.2.22-13+deb7u6_amd64.deb
 61a96ab7e2b16f0f6508876ee5151d6e 2354 httpd optional apache2-mpm-prefork_2.2.22-13+deb7u6_amd64.deb
 889658ad3111abf6d6a2e898e65ac258 2302 httpd optional apache2-mpm-event_2.2.22-13+deb7u6_amd64.deb
 a821200cf35ad246d1e285e97e1fb95e 2336 httpd extra apache2-mpm-itk_2.2.22-13+deb7u6_amd64.deb
 c9ca66c449eee52a62054d23dffa28df 163630 httpd optional apache2-utils_2.2.22-13+deb7u6_amd64.deb
 9ddb3f479cfbf8a069443395af29d258 107208 httpd optional apache2-suexec_2.2.22-13+deb7u6_amd64.deb
 18da857c479d33eb20c98b00d6a83408 108714 httpd extra apache2-suexec-custom_2.2.22-13+deb7u6_amd64.deb
 d674aa0966fb7f7595ddce49d21253fa 1438 httpd optional apache2_2.2.22-13+deb7u6_amd64.deb
 59a3c7147e1f772aded0bf72b81aee02 1776854 doc optional apache2-doc_2.2.22-13+deb7u6_all.deb
 015bf6eaa44b58b81688e315422b6ddd 114642 httpd extra apache2-prefork-dev_2.2.22-13+deb7u6_amd64.deb
 9c7fe63ccf26b1ffe718cb0030aa976a 115446 httpd extra apache2-threaded-dev_2.2.22-13+deb7u6_amd64.deb
 e12cab85b7fd9967add6c1851d73dae3 1726524 debug extra apache2-dbg_2.2.22-13+deb7u6_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBVdMAsMaHXzVBzv3gAQjuxg/8ClfHJfjh9x376ovEG4TeHCA6Rb45VSsh
8Wj/iu/ZDaqYiNXVArVz9tvTGaN9J2fkSTyA4ZqHOjS6IhUcthEAwkhiTCAQKDXQ
GCyGT9H1D/FA1VYaOfWcLW9yhKJs4VdgMlRjTeJULrFBpYeOXp3WowrBf06E+zjk
Hs7MLaa/+qq1/k7An4bh2t04sD1+RBNp5w8kxByishtnZovjYOYfJVad6lkSLBvn
JMY3688ptdAnBfDzHx6douTofxQ2MVKqLQS3aucJaxrYu1AeXscEqd5ESLzqNJhH
0kIRIBevl0uJXsRfLN/azu/vBFlKeXJtLS1ydbr5gildm46XYGdhfSltaCM/WGdD
NudvpaaO0hUGJHDuQnaVwhCTwJv7VAuLVEKR1P7NJTn7WjVDgqQAZiocBV4Gn8at
6zGiX7LI+pGu+MlaLx8BDg+QHMaNPtGuj+V/n0hxTlqctK89ZXsrT10Mvd9J4ku0
EY7dBSvCixoHgtuxPwi0qRwfDQ9famWLOimA0Wk9W0jrC0ORepFDoeLZwPOGL1HO
511ffP+sAVzXZTAIcVLhHIXXBA1VE/Lc9WlK7mTja1UyOwhF5cOaCIMf1g/VggZO
+TyCpt92M7IoXJIF0QdBVHeGSsz43qH57ZasjqtFUNCVRWQ60ni4azjKjNio4M6z
8gZRA+xBfNE=
=OLa0
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.