问题名称：SOLARIS 9@X86上的Apache2.0.48/49的MOD_SSL不能被加载
问题提出者：美丽人生
问题简叙：Apache2.0.48/49(两个都装过了)及其MOD_SSL都安装了，apachectl start 可以启动，apachectl startssl启动失败，
问题目的：让Apache2可以启动SSL
联系信息：QQ:18414710
相关信息：
1、操作系统：
1).详细版本信息：SOLARIS 9＠X86
2、编译器：
1).详细版本信息：gcc 3.3.2
2).详细安装过程：下载PKG包安装
3、服务器软件系统：
1).详细版本信息：Apache2.0.48/49
2).详细安装过程：下载源码编译安装
configure参数：./configure --prefix=/usr/local/apache2 --enable-mods-shared=most --enable-ssl=shared --with-mpm=prefork --enable-module=most --enable-mods-shared=all --enable-so
然后执行make，无错无信息，执行make install，无错无信息，
修改httpd.conf三项：User nobody
Group nogroup
ServerName zgm78.hotelweb.cn:80
3).详细运行记录：apachectl start执行成功，访问测试试页面成功
apachectl stop停止成功，
apachectl startssl执行失败，错误信息“Syntax error on line 249 of /usr/local/apache2/conf/httpd.conf:
Cannot load /usr/local/apache2/modules/mod_ssl.so into server: ld.so.1: /usr/local/apache2/bin/httpd: 致命的: 重定位错误: 文件/usr/local/apache2/modules/mod_ssl.so: 符号X509_INFO_free: 参照的符号没有找到”
4).详细附加信息：本人以前未装过基本的Apache，初次接触UNIX系统
4、问题：
1).简短问题名称：SOLARIS 9@X86上的Apache2.0.48/49的MOD_SSL不能被加载
2).详细问题描述：Apache2安装好了，apachectl start可以运行了，apache2 startssl运行失败。错误提示：“Syntax error on line 249 of /usr/local/apache2/conf/httpd.conf:
Cannot load /usr/local/apache2/modules/mod_ssl.so into server: ld.so.1: /usr/local/apache2/bin/httpd: 致命的: 重定位错误: 文件/usr/local/apache2/modules/mod_ssl.so: 符号X509_INFO_free: 参照的符号没有找到”，logs/error_log无日志。
3).问题可能原因：可能是因为编译配置不当,也可能是OPENSSL的问题。
4).详细你所进行过的操作：重复编译过几次，并将OPENSSL 0.97d换成OPENSSL 0 .97重新编译后问题依旧！
谢谢
| HonestQiao 回复于：2004-04-22 20:49:20 |
| 非常感谢支持，不过有一点你还没有做好哦，给你提出来，希望接纳：
提示了httpd.conf的249行出错了，可是你没有给出出错的附近的配置。 你的问题可能如下解决： 你需要创建一个运行时的SSL连接，可以按照如下方法： [code:1:4159c4bb64]#crle -c /var/ld/ld.config -l /usr/lib:/usr/local/lib:/usr/local/ssl/lib [/code:1:4159c4bb64] 记住这个里面的路径需要是你自己的相关路径 |
| HonestQiao 回复于：2004-04-22 20:50:56 |
| 这篇文章也可以值得你参考的：
[code:1:4af428cb53]On Thu, 9 Jan 2003, Tai Do wrote: [color=blue]> I'm trying to get Apache2 working on Solaris 8. I have the following error > and saw that your answer on the mailing list work. I was wondering if you > can help me out with it because I'm not too sure what to do. > > Syntax error on line 234 of /usr/local/apache2/conf/httpd.conf: > > Cannot load /usr/local/apache2/modules/mod_ssl.so into server: ld.so.1: > /usr/local/apache2/bin/httpd: fatal: relocation error: file > /usr/local/apache2/modules/mod_ssl.so: symbol X509_INFO_free: referenced > symbol not found. > > Here is the answer you posted: > >> Yes, it's a fairly frequently asked question. The problem is that >> you've built a shared mod_ssl against a static OpenSSL (ie, libssl.a >> and libcrypto.a instead of .so). That won't work because the way the >> build system currently works, OpenSSL is linked into httpd, not >> mod_ssl. httpd doesn't need the symbols from the OpenSSL libraries, so >> the static linker throws them away, meaning they're no longer available >> when mod_ssl is dynamically linked at runtime. >> >> Solution: use a shared OpenSSL. > > I was wondering how I use a shared OpenSSL. I was wondering if you can > point me to where I can find steps to do this or show me how.[/color] I'm CC:'ing this to the modssl-users list, since I'm sure somebody else out there probably has the same question. It's kind of annoying, because the shared library support in OpenSSL is "experimental", which in practice just means that the Makefile is non-intuitive. I just ran through it again to make sure I got all the steps right... here's what you do. I'm going to assume that you have the static version of OpenSSL installed in /usr/local/lib in this example... just fix the path to match where OpenSSL gets installed on your machine. So let's say you've installed OpenSSL previously, but it's the static version, so you have /usr/local/lib/libssl.a and /usr/local/lib/libcrypto.a . Remove those. Go back to the OpenSSL source directory and do the following: ./config make make build-shared mv libssl.so* /usr/local/lib mv libcrypto.so* /usr/local/lib ldconfig (note: do NOT run make install, or it will remove all your shared libraries and install the static ones, and you'll have to start over again. :-) That ought to do it. I recommend doing a search on your filesystem for other, older copies of libssl* and libcrypto* that might be hanging around, as sometimes copies get put in strange places and you want to be sure to only have one: the most recent. Hope that helps...[/code:1:4af428cb53] |
| 美丽人生 回复于：2004-04-22 23:06:45 |
| 谢谢版主，你的建议我一定接纳（不接纳是不行的，否则要被删贴的），得等到下周一才能回公司试试了，如果试了成不成功都一定再反馈上来！ |
| HonestQiao 回复于：2004-04-23 17:44:48 |
| 我有这么恐怖么？
我只是希望大家提出的问题是有价值的问题 |
| 美丽人生 回复于：2004-04-26 13:27:52 |
| 在WWW.SUNFREEWARE.COM下载了 httpd-2.0.49.tar.gz，按照要求首先安装了expat, libiconv, gdbm, openssl,
使用配置 ./configure --prefix=/usr/local/apache2 --enable-mods-shared=all --enable-ssl=shared --with-ssl=/usr/local/ssl 编译并安装后 在/usr/local/apache2/bin/下执行 ./apachectl startssl 显示错误： Syntax error on line 108 of /usr/local/apache2/conf/ssl.conf: SSLCertificateFile: file '/usr/local/apache2/conf/ssl.crt/server.crt' does not exist or is empty 相关配置： # Server Certificate: # Point SSLCertificateFile at a PEM encoded certificate. If # the certificate is encrypted, then you will be prompted for a # pass phrase. Note that a kill -HUP will prompt again. Keep # in mind that if you have both an RSA and a DSA certificate you # can configure both in parallel (to also allow the use of DSA # ciphers, etc.) SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server.crt #SSLCertificateFile /usr/local/apache2/conf/ssl.crt/server-dsa.crt 应该怎么制作测试证书得到这些文件？ 看到APACHE1的版本是使用make certificate，但这个版本这样执行失败 # make certificate TYPE=custom make: Fatal error: Don't know how to make target `certificate' |
| 美丽人生 回复于：2004-04-26 14:33:35 |
| 终于成功了，现整理一下希望对遇到相同问题的朋友有所帮助
1、安装配置APACHE服务： 在WWW.SUNFREEWARE.COM下载了 httpd-2.0.49.tar.gz，按照要求首先安装了expat, libiconv, gdbm, openssl, 使用配置 ./configure --prefix=/usr/local/apache2 --enable-mods-shared=all --enable-ssl=shared --with-ssl=/usr/local/ssl 编译并安装后，修改httpd.conf中ServerName，User，UserGroup 2、制作证书： 进入/usr/local/ssl/bin执行 openssl req -new -x509 -days 365 -nodes -out ssl.pem -keyout ssl.pem。 这将会创建一个自己给自己签名的证书。参数的含义： -days 365 使这个证书的有效期是1年，之后它将不能再用。 -new 创建一个新的证书 -x509 创建一个 X509 证书（自己签名的） -nodes 这个证书没有密码 -out ssl.pem 把 SSL 证书公钥写到哪里 -keyout ssl.pem 把 SSL 私钥放到这个文件中 在/usr/local/apache2/conf/下面建立文件夹ssl.crt与ssl.key,分别在两个目录下建立server.crt,server.key，分别把ssl.pem中的公钥、私钥拷贝到这两个文件中。 3、启动SSL 进入/usr/local/apache2/bin执行apachectl startssl如果没有报错，恭喜你，你成功启动了ssl |
| 江南第一快倒 回复于：2004-04-26 21:10:50 |
| my god...
还要制作证书... 我的安装完后也是这个问题， 我想问一下，不需要 openssl可以吗？ |
| 美丽人生 回复于：2004-04-27 00:57:40 |
| 不用OPENSSL，你也可以用其他提供SSL接口的模块，我是这么理解的，
但是，你为什么不用OPENSSL呢？ |
| kevinkan 回复于：2004-05-12 21:25:21 |
| 不行啊，我已经安装了expat, libiconv, gdbm, openssl ，在编译运行apache2后 还是出现Cannot load /usr/local/apache2/modules/mod_ssl.so X509的错误。
请问是什么原因造成？ |
