“SSL Library Error: -8181 Certificate has expired”解决方案（修改nss.conf配置文件）

今天发现Team的测试网站down掉了，去查了下服务器上的httpd进程都不存在了，第一反应是可能哪个冒失的同事不小心reboot了这个服务器；但我也一会就联想到前阵子也发生过类似一件事情，只是不同的服务器而已。都是apache中mod_nss这个module的问题，由于一些证书过期之类的，到时系统将apache的进程直接kill了。这是第二次遇到了，简单总结一下吧。

首先检查apache的error_log，我在/var/log/httpd/nss_error_log文件中看到如下错误。

Python

[Mon Dec 26 13:21:24 2011] [error] Certificate not verified: 'Server-Cert' [Mon Dec 26 13:21:24 2011] [error] SSL Library Error: -8181 Certificate has expired [Mon Dec 26 13:21:24 2011] [error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

1 2 3

[Mon Dec 26 13:21:24 2011] [error] Certificate not verified: 'Server-Cert' [Mon Dec 26 13:21:24 2011] [error] SSL Library Error: -8181 Certificate has expired [Mon Dec 26 13:21:24 2011] [error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

所以一个临时的解决方案就出来了，找到/etc/httpd/conf.d/nss.conf文件，在里面添加 "NSSEnforceValidCerts off" 这个配置即可。

仔细看一下，配置文件中有个如下配置，其实需要将SSL的Engine置为"off"也是可以的。

Python

# SSL Engine Switch: # Enable/Disable SSL for this virtual host. NSSEngine on

1 2 3

#   SSL Engine Switch: #   Enable/Disable SSL for this virtual host. NSSEngine on

而，命令"certutil -d /etc/httpd/alias -L -n Server-Cert" 可以查看nss中的certificate过期的时间，比如这个命令输出在某台机器上有如下的信息。（这个命令中的/etc/httpd/alias是nss.conf中这个值“NSSCertificateDatabase”的配置）

Python

Certificate: Data: Version: 3 (0x2) Serial Number: 3 (0x3) Signature Algorithm: PKCS #1 MD5 With RSA Encryption Issuer: "CN=Certificate Shack,O=example.com,C=US" Validity: Not Before: Fri Dec 21 03:56:05 2007 Not After : Wed Dec 21 03:56:05 2011

1 2 3 4 5 6 7 8 9

Certificate:     Data:         Version: 3 (0x2)         Serial Number: 3 (0x3)         Signature Algorithm: PKCS #1 MD5 With RSA Encryption         Issuer: "CN=Certificate Shack,O=example.com,C=US"         Validity:             Not Before: Fri Dec 21 03:56:05 2007             Not After : Wed Dec 21 03:56:05 2011

所以，当前时间是已经过期了的。（网上说在RHEL5中可能遇到这个问题【我也是rhel5.X中遇到的】，重新安装mod_nss的rpm包即可解决这个问题，但是我试了一下，这样并不成功。我还是通过修改nss.conf来解决的，或者也可以直接删除mod_nss，不是用这个安全方面的module即可。）由于并非系统管理员，也就只了解到这里了，我暂时就直接不再使用mod_nss了。

The mod_nss module provides strong cryptography for the Apache HTTP Server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, using the Network Security Services (NSS) security library.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

参考：

http://www.mozilla.org/projects/security/pki/nss/

http://directory.fedoraproject.org/docs/mod_nss.html