Otdfbt

CentOS 7 | Apache 2.4.6

I have built a private Certificate Authority (CA) and two certificates (one for the server and one for a client).

Then, I configured the Apache to use the certificate X.509 in order to answer HTTPS connections, and everything went fine (I saw it in the browser).

Then, when I was configuring the Client Authentication, restarted the server and got the following error:

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

Now it appears "Syntax OK" but I still can't start the server, getting the following errors, using the commands:

. systemctl status httpd.service

[root@localhost ~]# systemctl status httpd.service
● httpd.service - The Apache HTTP Server
 Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
 Active: failed (Result: exit-code) since Wed 2019-05-01 18:35:40 WEST; 2min 3s ago
 Docs: man:httpd(8)
 man:apachectl(8)
 Process: 12292 ExecStop=/bin/kill -WINCH $MAINPID (code=exited, status=1/FAILURE)
 Process: 12288 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 12288 (code=exited, status=1/FAILURE)

May 01 18:35:37 src_ca systemd[1]: Starting The Apache HTTP Server...
May 01 18:35:40 src_ca systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
May 01 18:35:40 src_ca kill[12292]: kill: cannot find process ""
May 01 18:35:40 src_ca systemd[1]: httpd.service: control process exited, code=exited status=1
May 01 18:35:40 src_ca systemd[1]: Failed to start The Apache HTTP Server.
May 01 18:35:40 src_ca systemd[1]: Unit httpd.service entered failed state.
May 01 18:35:40 src_ca systemd[1]: httpd.service failed.

."journalctl -xe"

May 01 18:39:16 src_ca polkitd[2607]: Registered Authentication Agent for unix-process:12474:9099194 (system bus name :1.157 [/usr/bin/pkttyagent --notify-fd 5 --fallba
May 01 18:39:16 src_ca systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit httpd.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit httpd.service has begun starting up.
May 01 18:39:18 src_ca systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
May 01 18:39:18 src_ca kill[12483]: kill: cannot find process ""
May 01 18:39:18 src_ca systemd[1]: httpd.service: control process exited, code=exited status=1
May 01 18:39:18 src_ca systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit httpd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit httpd.service has failed.
--
-- The result is failed.
May 01 18:39:18 src_ca systemd[1]: Unit httpd.service entered failed state.
May 01 18:39:18 src_ca systemd[1]: httpd.service failed.
May 01 18:39:18 src_ca polkitd[2607]: Unregistered Authentication Agent for unix-process:12474:9099194 (system bus name :1.157, object path /org/freedesktop/PolicyKit1/

I'll leave bellow the process that I have used to configure the Client Authentication. I'll leave some useful files at the bottom of the question.

Procedure to configure the Client Authentication

1. Started by locating the option "SSLCACertificateFile" in the file “/etc/httpd/conf.d/ssl.conf”: vi +/SSLCACertificateFile /etc/httpd/conf.d/ssl.conf




2. Updated the path to: /etc/pki/CA/certs/ca.crt

This is the location of the certificate for the CA.

To note: The certificate of the client is inside the folder /etc/pki/CA/certs. I am not sure if this causes any problem when configuring the Client Authentication. (Update: Edit 1)

3. Removed the "#" on the directive "SSLVerifyClient require".




4. Saved the changed and exited the file with :wq and then restarted the server: systemctl restart httpd

Useful Files for debug

. "etc/hosts" (Adding the IP + Host)

. "/etc/hostname" (Can be done with hostnamectl set-hostname new-hostname)

. "etc/httpd/conf/httpd.conf"

. "/etc/httpd/conf.d/ssl.conf"

. "/var/log/httpd/error_log"

[Wed May 01 18:18:13.050768 2019] [core:notice] [pid 11416] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Wed May 01 18:18:13.053282 2019] [suexec:notice] [pid 11416] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[We May 01 18:18:16.238779 2019] [ssl:emerg] [pid 11416] AH02311: Fatal error initialising mod_ssl, exiting. See /etc/httpd/logs/ssl_error_log for more information

. " /var/log/httpd/ssl_error_log"

[Wed May 01 18:18:16.238749 2019] [ssl:emerg] [pid 11416] AH01895: Unable to configure verify locations for client authentication

I have used a certificate built on another context, restarted Apache, the errors were not showing.

That means the error must be with the certificate.

Given that, I re-watched carefully the procedure that I have used to build the CA (I'll add the procedure at the bottom of this answer) and found the error.

I was using the "temporary" certificate instead of cacert.pem.

Procedure to create the CA:

1. openssl genrsa -des3 -out /etc/pki/CA/private/cakey.pem




2. openssl req -new -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/ca.crt




3. openssl x509 -req -days 100 -in ca.crt -out cacert.pem -signkey private/cakey.pem