Fedora directory users - Dec 2008 - Error starting SSL enabled Admin-Server Segmentation fault (11)

Hello,
I have 2 servers running FDS.
I have setup My directory servers to use SSL for the directory server
and Admin server. For my problem server I generated both the directory
server cert and admin server cert on  the directory server acting as the
CA. I exported the Server-Cert2, server-cert2 in .p12 format and I
imported them as well as the CA cert into both the admin server and
directory server. I am able to establish SSL client sessions to the
directory server but I cannot login to the admin server through the
GUI. 
I was able to login fine before enabling SSL...Unlike on this server,
the server acting as the root CA everything works fine.

I get the following error at the GUI login screen.
 authenticating User ID "cn=Directory Manager"
java.io.InterruptedIOException: HTTP response timeout

In the error log I have this. The directory server that I can log into I
get the same messages but not the segmentation fault. 


[notice] caught SIGTERM, shutting down
[notice] Access Host filter is: *.fedora
[notice] Access Address filter is: *
[notice] Access Host filter is: *.fedora
[notice] Access Address filter is: *
[error] SSL_InheritMPServerSIDCache failed
[error] SSL Library Error: -8191 Library Failure
[notice] Apache/2.2.8 (Unix) configured -- resuming normal operations
[notice] child pid 3284 exit signal Segmentation fault (11)

Here are my Cert data bases

[root@scooby ~]# certutil -L -d /etc/dirsrv/admin-serv/

Certificate Nickname                                         Trust
Attributes

SSL,S/MIME,JAR/XPI

CA certificate                                               CT,, 
server-cert2                                                 u,u,u
[root@scooby ~]# certutil -L -d /etc/dirsrv/slapd-scooby/

Certificate Nickname                                         Trust
Attributes

SSL,S/MIME,JAR/XPI

CA certificate                                               CT,, 
Server-Cert2                                                 u,u,u






Any ideas.

Thanks
James

CONFIDENTIALITY
This e-mail message and any attachments thereto, is intended only for use by the
addressee(s) named herein and may contain legally privileged and/or confidential
information. If you are not the intended recipient of this e-mail message, you
are hereby notified that any dissemination, distribution or copying of this
e-mail message, and any attachments thereto, is strictly prohibited.  If you
have received this e-mail message in error, please immediately notify the sender
and permanently delete the original and any copies of this email and any prints
thereof.
ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT
INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the Uniform Electronic
Transactions Act or the applicability of any other law of similar substance and
effect, absent an express statement to the contrary hereinabove, this e-mail
message its contents, and any attachments hereto are not intended to represent
an offer or acceptance to enter into a contract and are not otherwise intended
to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any
other person or entity.

James Chavez wrote:
> Hello,
> I have 2 servers running FDS.
> I have setup My directory servers to use SSL for the directory server
> and Admin server. For my problem server I generated both the directory
> server cert and admin server cert on  the directory server acting as the
> CA. I exported the Server-Cert2, server-cert2 in .p12 format and I
> imported them as well as the CA cert into both the admin server and
> directory server. I am able to establish SSL client sessions to the
> directory server but I cannot login to the admin server through the
> GUI. 
> I was able to login fine before enabling SSL...Unlike on this server,
> the server acting as the root CA everything works fine.
>
> I get the following error at the GUI login screen.
>  authenticating User ID "cn=Directory Manager"
> java.io.InterruptedIOException: HTTP response timeout
>
> In the error log I have this. The directory server that I can log into I
> get the same messages but not the segmentation fault. 
>
>
> [notice] caught SIGTERM, shutting down
> [notice] Access Host filter is: *.fedora
> [notice] Access Address filter is: *
> [notice] Access Host filter is: *.fedora
> [notice] Access Address filter is: *
> [error] SSL_InheritMPServerSIDCache failed
> [error] SSL Library Error: -8191 Library Failure
> [notice] Apache/2.2.8 (Unix) configured -- resuming normal operations
> [notice] child pid 3284 exit signal Segmentation fault (11)
>   
What platform?  What version of fedora-ds-admin?
rpm -qi fedora-ds-admin
> Here are my Cert data bases
>
> [root@scooby ~]# certutil -L -d /etc/dirsrv/admin-serv/
>
> Certificate Nickname                                         Trust
> Attributes
>
> SSL,S/MIME,JAR/XPI
>
> CA certificate                                               CT,, 
> server-cert2                                                 u,u,u
> [root@scooby ~]# certutil -L -d /etc/dirsrv/slapd-scooby/
>
> Certificate Nickname                                         Trust
> Attributes
>
> SSL,S/MIME,JAR/XPI
>
> CA certificate                                               CT,, 
> Server-Cert2                                                 u,u,u
>
>
>
>
>
>
> Any ideas.
>
> Thanks
> James
>
> CONFIDENTIALITY
> This e-mail message and any attachments thereto, is intended only for use
by the addressee(s) named herein and may contain legally privileged and/or
confidential information. If you are not the intended recipient of this e-mail
message, you are hereby notified that any dissemination, distribution or copying
of this e-mail message, and any attachments thereto, is strictly prohibited.  If
you have received this e-mail message in error, please immediately notify the
sender and permanently delete the original and any copies of this email and any
prints thereof.
> ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT
INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the Uniform Electronic
Transactions Act or the applicability of any other law of similar substance and
effect, absent an express statement to the contrary hereinabove, this e-mail
message its contents, and any attachments hereto are not intended to represent
an offer or acceptance to enter into a contract and are not otherwise intended
to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any
other person or entity.
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

Thank you,
I am running Fedora Core 9 on both of the Servers.

Here is the output of rpm -qi 

Name        : fedora-ds-admin              Relocations: (not
relocatable)
Version     : 1.1.4                             Vendor: Fedora Project
Release     : 1.fc9                         Build Date: Tue 15 Apr 2008
10:31:42 AM MST
Install Date: Tue 07 Oct 2008 10:15:03 PM MST      Build Host:
xenbuilder4.fedora.phx.redhat.com
Group       : System Environment/Daemons    Source RPM:
fedora-ds-admin-1.1.4-1.fc9.src.rpm

James



On Tue, 2008-12-09 at 15:05 -0700, Rich Megginson wrote:
> James Chavez wrote:
> > Hello,
> > I have 2 servers running FDS.
> > I have setup My directory servers to use SSL for the directory server
> > and Admin server. For my problem server I generated both the directory
> > server cert and admin server cert on  the directory server acting as
the
> > CA. I exported the Server-Cert2, server-cert2 in .p12 format and I
> > imported them as well as the CA cert into both the admin server and
> > directory server. I am able to establish SSL client sessions to the
> > directory server but I cannot login to the admin server through the
> > GUI. 
> > I was able to login fine before enabling SSL...Unlike on this server,
> > the server acting as the root CA everything works fine.
> >
> > I get the following error at the GUI login screen.
> >  authenticating User ID "cn=Directory Manager"
> > java.io.InterruptedIOException: HTTP response timeout
> >
> > In the error log I have this. The directory server that I can log into
I
> > get the same messages but not the segmentation fault. 
> >
> >
> > [notice] caught SIGTERM, shutting down
> > [notice] Access Host filter is: *.fedora
> > [notice] Access Address filter is: *
> > [notice] Access Host filter is: *.fedora
> > [notice] Access Address filter is: *
> > [error] SSL_InheritMPServerSIDCache failed
> > [error] SSL Library Error: -8191 Library Failure
> > [notice] Apache/2.2.8 (Unix) configured -- resuming normal operations
> > [notice] child pid 3284 exit signal Segmentation fault (11)
> >   
> What platform?  What version of fedora-ds-admin?
> rpm -qi fedora-ds-admin
> > Here are my Cert data bases
> >
> > [root@scooby ~]# certutil -L -d /etc/dirsrv/admin-serv/
> >
> > Certificate Nickname                                         Trust
> > Attributes
> >
> > SSL,S/MIME,JAR/XPI
> >
> > CA certificate                                               CT,, 
> > server-cert2                                                 u,u,u
> > [root@scooby ~]# certutil -L -d /etc/dirsrv/slapd-scooby/
> >
> > Certificate Nickname                                         Trust
> > Attributes
> >
> > SSL,S/MIME,JAR/XPI
> >
> > CA certificate                                               CT,, 
> > Server-Cert2                                                 u,u,u
> >
> >
> >
> >
> >
> >
> > Any ideas.
> >
> > Thanks
> > James
> >
> > CONFIDENTIALITY
> > This e-mail message and any attachments thereto, is intended only for
use by the addressee(s) named herein and may contain legally privileged and/or
confidential information. If you are not the intended recipient of this e-mail
message, you are hereby notified that any dissemination, distribution or copying
of this e-mail message, and any attachments thereto, is strictly prohibited.  If
you have received this e-mail message in error, please immediately notify the
sender and permanently delete the original and any copies of this email and any
prints thereof.
> > ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL
IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the Uniform
Electronic Transactions Act or the applicability of any other law of similar
substance and effect, absent an express statement to the contrary hereinabove,
this e-mail message its contents, and any attachments hereto are not intended to
represent an offer or acceptance to enter into a contract and are not otherwise
intended to bind the sender, Sanmina-SCI Corporation (or any of its
subsidiaries), or any other person or entity.
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users@redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >   
> 
CONFIDENTIALITY
This e-mail message and any attachments thereto, is intended only for use by the
addressee(s) named herein and may contain legally privileged and/or confidential
information. If you are not the intended recipient of this e-mail message, you
are hereby notified that any dissemination, distribution or copying of this
e-mail message, and any attachments thereto, is strictly prohibited.  If you
have received this e-mail message in error, please immediately notify the sender
and permanently delete the original and any copies of this email and any prints
thereof.
ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT
INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the Uniform Electronic
Transactions Act or the applicability of any other law of similar substance and
effect, absent an express statement to the contrary hereinabove, this e-mail
message its contents, and any attachments hereto are not intended to represent
an offer or acceptance to enter into a contract and are not otherwise intended
to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any
other person or entity.

James Chavez wrote:
> Thank you,
> I am running Fedora Core 9 on both of the Servers.
>
> Here is the output of rpm -qi 
>
> Name        : fedora-ds-admin              Relocations: (not
> relocatable)
> Version     : 1.1.4                             Vendor: Fedora Project
> Release     : 1.fc9                         Build Date: Tue 15 Apr 2008
> 10:31:42 AM MST
> Install Date: Tue 07 Oct 2008 10:15:03 PM MST      Build Host:
> xenbuilder4.fedora.phx.redhat.com
> Group       : System Environment/Daemons    Source RPM:
> fedora-ds-admin-1.1.4-1.fc9.src.rpm
>   
The current version is 1.1.6.  Most likely you need to do a
yum upgrade
in order to pull the latest version from the fedora-updates-newkey
repo
> James
>
>
>
> On Tue, 2008-12-09 at 15:05 -0700, Rich Megginson wrote:
>   
>> James Chavez wrote:
>>     
>>> Hello,
>>> I have 2 servers running FDS.
>>> I have setup My directory servers to use SSL for the directory
server
>>> and Admin server. For my problem server I generated both the
directory
>>> server cert and admin server cert on  the directory server acting
as the
>>> CA. I exported the Server-Cert2, server-cert2 in .p12 format and I
>>> imported them as well as the CA cert into both the admin server and
>>> directory server. I am able to establish SSL client sessions to the
>>> directory server but I cannot login to the admin server through the
>>> GUI. 
>>> I was able to login fine before enabling SSL...Unlike on this
server,
>>> the server acting as the root CA everything works fine.
>>>
>>> I get the following error at the GUI login screen.
>>>  authenticating User ID "cn=Directory Manager"
>>> java.io.InterruptedIOException: HTTP response timeout
>>>
>>> In the error log I have this. The directory server that I can log
into I
>>> get the same messages but not the segmentation fault. 
>>>
>>>
>>> [notice] caught SIGTERM, shutting down
>>> [notice] Access Host filter is: *.fedora
>>> [notice] Access Address filter is: *
>>> [notice] Access Host filter is: *.fedora
>>> [notice] Access Address filter is: *
>>> [error] SSL_InheritMPServerSIDCache failed
>>> [error] SSL Library Error: -8191 Library Failure
>>> [notice] Apache/2.2.8 (Unix) configured -- resuming normal
operations
>>> [notice] child pid 3284 exit signal Segmentation fault (11)
>>>   
>>>       
>> What platform?  What version of fedora-ds-admin?
>> rpm -qi fedora-ds-admin
>>     
>>> Here are my Cert data bases
>>>
>>> [root@scooby ~]# certutil -L -d /etc/dirsrv/admin-serv/
>>>
>>> Certificate Nickname                                         Trust
>>> Attributes
>>>
>>> SSL,S/MIME,JAR/XPI
>>>
>>> CA certificate                                               CT,, 
>>> server-cert2                                                 u,u,u
>>> [root@scooby ~]# certutil -L -d /etc/dirsrv/slapd-scooby/
>>>
>>> Certificate Nickname                                         Trust
>>> Attributes
>>>
>>> SSL,S/MIME,JAR/XPI
>>>
>>> CA certificate                                               CT,, 
>>> Server-Cert2                                                 u,u,u
>>>
>>>
>>>
>>>
>>>
>>>
>>> Any ideas.
>>>
>>> Thanks
>>> James
>>>
>>> CONFIDENTIALITY
>>> This e-mail message and any attachments thereto, is intended only
for use by the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient of this
e-mail message, you are hereby notified that any dissemination, distribution or
copying of this e-mail message, and any attachments thereto, is strictly
prohibited.  If you have received this e-mail message in error, please
immediately notify the sender and permanently delete the original and any copies
of this email and any prints thereof.
>>> ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS
E-MAIL IS NOT INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the
Uniform Electronic Transactions Act or the applicability of any other law of
similar substance and effect, absent an express statement to the contrary
hereinabove, this e-mail message its contents, and any attachments hereto are
not intended to represent an offer or acceptance to enter into a contract and
are not otherwise intended to bind the sender, Sanmina-SCI Corporation (or any
of its subsidiaries), or any other person or entity.
>>>
>>> --
>>> Fedora-directory-users mailing list
>>> Fedora-directory-users@redhat.com
>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>   
>>>       
>
> CONFIDENTIALITY
> This e-mail message and any attachments thereto, is intended only for use
by the addressee(s) named herein and may contain legally privileged and/or
confidential information. If you are not the intended recipient of this e-mail
message, you are hereby notified that any dissemination, distribution or copying
of this e-mail message, and any attachments thereto, is strictly prohibited.  If
you have received this e-mail message in error, please immediately notify the
sender and permanently delete the original and any copies of this email and any
prints thereof.
> ABSENT AN EXPRESS STATEMENT TO THE CONTRARY HEREINABOVE, THIS E-MAIL IS NOT
INTENDED AS A SUBSTITUTE FOR A WRITING.  Notwithstanding the Uniform Electronic
Transactions Act or the applicability of any other law of similar substance and
effect, absent an express statement to the contrary hereinabove, this e-mail
message its contents, and any attachments hereto are not intended to represent
an offer or acceptance to enter into a contract and are not otherwise intended
to bind the sender, Sanmina-SCI Corporation (or any of its subsidiaries), or any
other person or entity.
>