error message x16\x03\x01

SSL setup

[jscjso]

I have Apache 2.0.63 on a Win32, and I have the http working.
Then I added a certificate and tried to get https working . Problem started,
I have error message as “ invalid method in request \x16\x03\x01”

Here are the key lines in my httpd.conf

***************************************************
ServerRoot "C:/Apache Group/Apache2"
PidFile logs/httpd.pid
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
<IfModule mpm_winnt.c>
ThreadsPerChild 250
MaxRequestsPerChild 0
</IfModule>

Listen 80

LoadModule access_module modules/mod_access.so
LoadModule actions_module modules/mod_actions.so
LoadModule alias_module modules/mod_alias.so
LoadModule asis_module modules/mod_asis.so
LoadModule auth_module modules/mod_auth.so
#LoadModule auth_anon_module modules/mod_auth_anon.so
#LoadModule auth_dbm_module modules/mod_auth_dbm.so
#LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule autoindex_module modules/mod_autoindex.so
#LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule cgi_module modules/mod_cgi.so
#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule dir_module modules/mod_dir.so
LoadModule env_module modules/mod_env.so
#LoadModule expires_module modules/mod_expires.so
#LoadModule file_cache_module modules/mod_file_cache.so
#LoadModule headers_module modules/mod_headers.so
LoadModule imap_module modules/mod_imap.so
LoadModule include_module modules/mod_include.so
#LoadModule info_module modules/mod_info.so
LoadModule isapi_module modules/mod_isapi.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule mime_module modules/mod_mime.so
#LoadModule mime_magic_module modules/mod_mime_magic.so
#LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule negotiation_module modules/mod_negotiation.so
#LoadModule rewrite_module modules/mod_rewrite.so
LoadModule setenvif_module modules/mod_setenvif.so
#LoadModule speling_module modules/mod_speling.so
#LoadModule status_module modules/mod_status.so
#LoadModule unique_id_module modules/mod_unique_id.so
LoadModule userdir_module modules/mod_userdir.so
#LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule vhost_alias_module modules/mod_vhost_alias.so

LoadModule ssl_module modules/mod_ssl.so

Listen 443

ServerName localhost:80

UseCanonicalName Off

DocumentRoot "C:/Apache Group/Apache2/htdocs"

<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>

<Directory "C:/Apache Group/Apache2/htdocs">
Options FollowSymLinks ExecCGI Includes
AddHandler server-parsed .html
AllowOverride None
Order allow,deny
Allow from all
</Directory>

UserDir "My Documents/My Website"
DirectoryIndex index.html

<FilesMatch "^\.ht">
Order allow,deny
Deny from all
</FilesMatch>

TypesConfig conf/mime.types
DefaultType text/plain

<IfModule mod_mime_magic.c>
MIMEMagicFile conf/magic
</IfModule>

HostnameLookups Off
ErrorLog logs/error.log
CustomLog logs/access.log common

ServerTokens Full
ServerSignature On

<Directory "C:/Apache Group/Apache2/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>

<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>
***************************************

Here are the key lines in my ssl.conf
*****************************************
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin

<IfDefine SSL>

Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache dbm:logs/ssl_scache
SSLSessionCacheTimeout 300
SSLMutex default

NameVirtualHost *:443

<VirtualHost *:443>

DocumentRoot "C:/Apache Group/Apache2/htdocs"
ServerName localhost:443

ErrorLog logs/error_log
TransferLog logs/access_log

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile conf/ideatodo.crt
SSLCertificateKeyFile conf/ideatodo.key

SSL Protocol all

<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Satisfy all
</Directory>

<FilesMatch "\.(cgi¦shtml¦phtml¦php3?)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "C:/Apache Group/Apache2/cgi">
SSLOptions +StdEnvVars
</Directory>

SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

</IfDefine>
***********************************************************

I think I have everthing in the httpd.conf and ssl.conf, can anyone seeing any problem with my setup. Any suggestion will be helpful.

[gergoe]

Remove

<IfDefine SSL>

and

</IfDefine>

, or start your Apache by adding the -D SSL parameter to the shortcut. See <IfDefine> [httpd.apache.org].

The reason for your error message is that the browser tries to initiate an SSL connection with your webserver, but since the SSL is not initialized on port 443 (but you added Listen 443 into the main configuration - outside of IfDefine), the Apache treats request as a normal http request - and that fails.

[jscjso]

Gergoe,

Thanks for a quick reply.

When I removed the <IfDefine SSL> and </IfDefine> lines from the ssl.conf file, Apache could not start. I kept on clicking the START button and Apache did not run. I logout and log back on and Apache could not start. I tried the 'test configuration' and there was no error message.

I am in Window environment, I do not know how to use -D.

I finally kept the two lines to keep apache to run and moved the Listen 443 around;
1. in the ssl.conf file,
2. within the <virtualHost _default_:443> container,
3. and within the <IfModule mod_ssl.c> and </IfModule>.

I still got x16\x03\x01 error when I clicked a href link(https://localhost/index2.html page).

[Key_Master]

Ok, I can see by your many posts here and elsewhere that this issue is keeping you up late at night. I understand- setting up SSL can be a pain in the arse. Here's a working sample from an Apache/SSL server I run on a Windows machine. Replace your httpd.conf file with this one. No need for a ssl.conf file. Hope this helps.

ThreadsPerChild 250
MaxRequestsPerChild 0

ServerRoot "C:/Apache Group/Apache2"

ServerName localhost

Listen 80
Listen 443

LoadModule actions_module modules/mod_actions.so
LoadModule alias_module modules/mod_alias.so
#LoadModule asis_module modules/mod_asis.so
LoadModule auth_basic_module modules/mod_auth_basic.so
#LoadModule auth_digest_module modules/mod_auth_digest.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authn_file_module modules/mod_authn_file.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule autoindex_module modules/mod_autoindex.so
#LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule cgi_module modules/mod_cgi.so
#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#LoadModule deflate_module modules/mod_deflate.so
LoadModule dir_module modules/mod_dir.so
LoadModule env_module modules/mod_env.so
LoadModule expires_module modules/mod_expires.so
#LoadModule file_cache_module modules/mod_file_cache.so
LoadModule headers_module modules/mod_headers.so
#LoadModule imagemap_module modules/mod_imagemap.so
LoadModule include_module modules/mod_include.so
#LoadModule info_module modules/mod_info.so
#LoadModule isapi_module modules/mod_isapi.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule mime_module modules/mod_mime.so
#LoadModule mime_magic_module modules/mod_mime_magic.so
#LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule setenvif_module modules/mod_setenvif.so
#LoadModule speling_module modules/mod_speling.so
#LoadModule status_module modules/mod_status.so
#LoadModule unique_id_module modules/mod_unique_id.so
#LoadModule userdir_module modules/mod_userdir.so
#LoadModule usertrack_module modules/mod_usertrack.so
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule ssl_module modules/mod_ssl.so

DocumentRoot "C:/Apache Group/Apache2/htdocs"
<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Satisfy all
</Directory>

AccessFileName .htaccess

<FilesMatch "^\.ht">
Order allow,deny
Deny from all
</FilesMatch>

<IfModule log_config_module>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
</IfModule>

ErrorLog C:/My Documents/My Website/error_logs/error.log
CustomLog C:/My Documents/My Website/access_logs/access.log combined
LogLevel info

DefaultType text/plain

<IfModule mime_module>
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
</IfModule>

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>

NameVirtualHost *:80

<VirtualHost _default_:80>
DocumentRoot "C:/Apache Group/Apache2/htdocs"
<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Satisfy all
</Directory>
</VirtualHost>

<VirtualHost *:80>
ServerName www.example.com:80
ServerAlias localhost example.com
ServerAdmin [e-mail]
DocumentRoot "C:/My Documents/My Website/public_html"
DirectoryIndex index.html
<Directory "C:/My Documents/My Website/public_html">
Options -Indexes FollowSymLinks Includes
AllowOverride All
Order allow,deny
Allow from all
</Directory>
ScriptAlias /cgi-bin/ "C:/My Documents/My Website/public_html/cgi-bin/"
<Directory "C:/My Documents/My Website/public_html/cgi-bin">
AllowOverride All
Options FollowSymLinks
Order allow,deny
Allow from all
</Directory>
ErrorLog C:/My Documents/My Website/error_logs/error.log
CustomLog C:/My Documents/My Website/access_logs/access.log combined
LogLevel info
</VirtualHost>

NameVirtualHost *:443

<VirtualHost _default_:443>
SSLEngine On
SSLCertificateFile C:/My Documents/My Website/ssl/example.cert
SSLCertificateKeyFile C:/My Documents/My Website/ssl/example.key
DocumentRoot "C:/Apache Group/Apache2/htdocs"
<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
Satisfy all
</Directory>
</VirtualHost>

<VirtualHost *:443>
SSLEngine On
SSLCertificateFile C:/My Documents/My Website/ssl/example.cert
SSLCertificateKeyFile C:/My Documents/My Website/ssl/example.key
ServerName www.example.com:443
ServerAlias localhost example.com
ServerAdmin [e-mail]
DocumentRoot "C:/My Documents/My Website/public_html"
DirectoryIndex index.html
<Directory "C:/My Documents/My Website/public_html">
Options -Indexes FollowSymLinks Includes
AllowOverride All
Order allow,deny
Allow from all
</Directory>
ScriptAlias /cgi-bin/ "C:/My Documents/My Website/public_html/cgi-bin/"
<Directory "C:/My Documents/My Website/public_html/cgi-bin">
AllowOverride All
Options FollowSymLinks
Order allow,deny
Allow from all
</Directory>
ErrorLog C:/My Documents/My Website/error_logs/error_ssl.log
CustomLog C:/My Documents/My Website/access_logs/access_ssl.log combined
LogLevel info
</VirtualHost>

Create the following directories...

These folders will store your log files:

C:/My Documents/My Website/error_logs
C:/My Documents/My Website/access_logs

Place your cert/key files in this folder:

C:/My Documents/My Website/ssl

This will be the public root of your site where your html pages, etc will be stored:

C:/My Documents/My Website/public_html

This will be where you will store and run your cgi scripts from:

C:/My Documents/My Website/public_html/cgi-bin

Of course you will also need to change example.com to whatever domain you point to your server (no rush, you can get this working first) and you will need to change C:/My Documents/My Website to whatever it really is on your computer.

Also, you need to make an exception for port 443 in the Windows Firewall settings.

[gergoe]

Do you have the C:/Apache Group/Apache2/logs folder present? If so, check the error.log file there, that will give you a clue on what's up. You could also try running Apache in a console window, just navigate to C:/Apache Group/Apache2/bin and execute apache.exe, you might get standard windows message boxes (which does not appear when running it as a service)

Also make sure you have the ideatodo.crt and ideatodo.key files in your C:/Apache Group/Apache2/conf folder, and that the private key does have the passphrase removed (if you use OpenSSL, then do

openssl -rsa -in ideatodo.key -out ideatodo.key

). However please note that I'm not an OpenSSL expert at all :-)

[jscjso]

Gergoe, Key Master,

Wow, what can I say! I have spent about 150 hours to debug the problem since I added SSL. You finally gave me the right direction to solve my problem. I have switched from Apache2.2.9 back to Apache2.0.63 to avoid the openssl0.9.8 bug, I have done try and error conbined and separated ssl.conf+httpd.conf file/s. I switched back to Abyss to verify my belief(it works for me in Abyss). I collected suggestions from various places and none work. I spent my midnights quietly to debug. Finally you gave me the solution.

here is what I did:
1. I took the single httpd.conf(no ssl.conf file) from above,
2. since my Apache2.0.63 does not support the authn* and authz*, I replaced all of them with one LoadModule ( LoadModule auth_module modules/mod_auth.so)
3. I added LoadModule access_module modules/mod_access.so to make 'Order' works
4. (this is optional), I change the

Order deny,allow
Deny from all

to

Order allow,deny
Allow from all

to avoid using password to access my site.

Then my [example1.html...] works.

Hope this explanation can help the next guy.

My next step will be to make the https;//example2.pl to work.

Thanks for overcoming this for me. Apache is hard to use, but is more flexible, that is the great reward.(comparing to GUI interfacing Abyss).