apache - HTTPD 不会在 Centos OS 7/Apache 2.4.6 上启动

Question

他们是 Centos 7/Apache 2.4.6 专家吗？

我是 Web 服务器的新手，但我已经阅读了 Go Daddy 的支持说明、Apache HTTPD 支持站点以及我能找到的有关此问题的所有其他支持论坛。

我已经使用 HTTPD 2.4.6 设置了 Centos 7 服务器。我使用 Open SSL 和 CSR 创建了私钥并将请求发送给 Go Daddy。我收到了三个文件:服务器证书文件和 CA 捆绑文件。我已将这些文件复制到我的服务器。我已经设置了虚拟主机配置文件:

<VirtualHost *:443>
ServerName www.laggersec.org
ServerAlias laggersec.org
DocumentRoot /var/www/laggersec.org/html
ErrorLog /var/www/laggersec.org/log/error.log
CustomLog /var/www/laggersec.org/log/requests.log combined
SSLEngine on
SSLProtocol -all +TLSv1.2
SSLCertificateFile /etc/ssl/certs/laggersec.org.crt
SSLCertificateKeyFile /etc/ssl/certs/private/laggersec.org.key
SSLCertificateChainFile /etc/ssl/certs/intermediate.crt
</VirtualHost>

但是，每当我启动 httpd 时，它都会失败并出现错误。

[root@LAGGERSEC1WEB1 slaggeradmin04]# apachectl restart
Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
[root@LAGGERSEC1WEB1 slaggeradmin04]# systemctl status httpd.service
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2020-03-23 17:24:10 UTC; 10s ago
     Docs: man:httpd(8)
           man:apachectl(8)
  Process: 116366 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE)
  Process: 116365 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 116365 (code=exited, status=1/FAILURE)

Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Starting The Apache HTTP Server...
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Mar 23 17:24:10 LAGGERSEC1WEB1 kill[116366]: kill: cannot find process ""
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service: control process exited, code=exited status=1
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Failed to start The Apache HTTP Server.
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Unit httpd.service entered failed state.
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service failed.

[root@LAGGERSEC1WEB1 slaggeradmin04]# journalctl -xe
--
-- Unit user-0.slice has finished starting up.
--
-- The start-up result is done.
Mar 23 17:24:01 LAGGERSEC1WEB1 systemd[1]: Started Session 1533 of user root.
-- Subject: Unit session-1533.scope has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit session-1533.scope has finished starting up.
--
-- The start-up result is done.
Mar 23 17:24:02 LAGGERSEC1WEB1 CROND[116341]: (root) CMD ([ -f /etc/krb5.keytab ] && [ \( ! -f /etc/opt/omi/creds/omi.keytab \) -o \( /etc/krb5.keytab
Mar 23 17:24:02 LAGGERSEC1WEB1 systemd[1]: Removed slice User Slice of root.
-- Subject: Unit user-0.slice has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit user-0.slice has finished shutting down.
Mar 23 17:24:10 LAGGERSEC1WEB1 polkitd[616]: Registered Authentication Agent for unix-process:116359:6177048 (system bus name :1.3444 [/usr/bin/pkttyag
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Starting The Apache HTTP Server...
-- Subject: Unit httpd.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit httpd.service has begun starting up.
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Mar 23 17:24:10 LAGGERSEC1WEB1 kill[116366]: kill: cannot find process ""
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service: control process exited, code=exited status=1
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit httpd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit httpd.service has failed.
--
-- The result is failed.
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: Unit httpd.service entered failed state.
Mar 23 17:24:10 LAGGERSEC1WEB1 systemd[1]: httpd.service failed.
Mar 23 17:24:10 LAGGERSEC1WEB1 polkitd[616]: Unregistered Authentication Agent for unix-process:116359:6177048 (system bus name :1.3444, object path /o
lines 4447-4486/4486 (END)

[root@LAGGERSEC1WEB1 slaggeradmin04]# cd /var/log/httpd
[root@LAGGERSEC1WEB1 httpd]# ls
access_log           error_log-20200308  off                      ssl_error_log           ssl_request_log-20200308
access_log-20200308  error_log-20200315  ssl_access_log           ssl_error_log-20200308  system_u:object_r:etc_t:s0
error_log            error_log-20200322  ssl_access_log-20200308  ssl_request_log
[root@LAGGERSEC1WEB1 httpd]# cat error_log
[Sun Mar 22 13:41:32.406464 2020] [suexec:notice] [pid 72981] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Mar 22 13:41:32.407451 2020] [ssl:emerg] [pid 72981] AH02311: Fatal error initialising mod_ssl, exiting. See /var/www/laggersec.org/log/error.log for more information
[Sun Mar 22 14:35:38.944945 2020] [suexec:notice] [pid 78824] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Sun Mar 22 14:35:38.945970 2020] [ssl:emerg] [pid 78824] AH02311: Fatal error initialising mod_ssl, exiting. See /var/www/laggersec.org/log/error.log for more information
[Mon Mar 23 14:03:41.301190 2020] [core:notice] [pid 95150] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon Mar 23 14:03:41.310673 2020] [suexec:notice] [pid 95150] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Mar 23 14:03:41.311961 2020] [ssl:emerg] [pid 95150] AH01903: Failed to configure CA certificate chain!
[Mon Mar 23 14:03:41.311973 2020] [ssl:emerg] [pid 95150] AH02312: Fatal error initialising mod_ssl, exiting.
[Mon Mar 23 14:29:46.498804 2020] [core:notice] [pid 97660] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon Mar 23 14:29:46.500217 2020] [suexec:notice] [pid 97660] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Mar 23 14:29:46.501001 2020] [ssl:emerg] [pid 97660] AH01903: Failed to configure CA certificate chain!
[Mon Mar 23 14:29:46.501007 2020] [ssl:emerg] [pid 97660] AH02312: Fatal error initialising mod_ssl, exiting.
[Mon Mar 23 17:24:10.788302 2020] [core:notice] [pid 116365] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Mon Mar 23 17:24:10.789746 2020] [suexec:notice] [pid 116365] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Mon Mar 23 17:24:10.790996 2020] [ssl:emerg] [pid 116365] AH01903: Failed to configure CA certificate chain!
[Mon Mar 23 17:24:10.791006 2020] [ssl:emerg] [pid 116365] AH02312: Fatal error initialising mod_ssl, exiting.

有没有高手可以帮帮我？

Answer 1

我想到了。我不得不使用 SSLCACertificateFile 指令而不是 SSLCertificateChainFile 指令。这是由于 Go Daddy 的证书不包含任何中间 CA 实体。