Windows – Apache 2.4 with OpenSSL service failing with “specific error Incorrect function”

opensslwindows 7

I downloaded Apache 2.4 from Apache Lounge and installed it on Windows 7, as a development server, and it worked fine. Now I'm try to use SSL with a self-signed certificate but restarting the service fails with:

The Apache2.4 service terminated with service-specific error Incorrect function..

I remember that Apache 2.2 had a specific OpenSSL download if you wanted to use SSL. Is this the case with Apache 2.4?

What else could cause the problem?

I have made sure that:

Ports 80 and 443 are free
LoadModule ssl_module modules/mod_ssl.so is uncommented
Include conf/extra/httpd-ssl.conf is also uncommented

Best Answer

I just had this same problem. By running httpd.exe itself, I was given the following output:

AH00526: Syntax error on line 92 of C:/Apache24/conf/extra/httpd-ssl.conf:
SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you
need to load the appropriate socache module (mod_socache_shmcb?).

The fix is to uncomment the following line in httpd.conf:

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Related Solutions

Disable Specific Cipher Suites Apache with WHM/cPanel

To add those directives to Apache via WHM you'd add them via :

Apache Configuration > Include Editor > Pre Main Include

and of course with the new issue with Poodle and disabling SSL v3 you'd probably want to make it :

SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS

However I believe you may also need to update the SSL Cipher suite settings within

Apache Configuration > Global Configuration > SSL Cipher Suite

to something like this :

ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP:!kEDH:!aNULL

Certainly when I updated my servers to disable SSLv3 and also disable the ciphers that allow anonymous authentication, doing the first bit alone still showed my server as reported them as being available, but doing the second part as well fixed it.

Openssl p12 generation failing with CA bundle chain option

I found (the|a) solution to this problem on this blog post. From the post:

After a bit of testing, I found that you need to make a new CAfile to be used, that combines the cacerts file from the openssl distribution and the intermediate.crt file...

...which is:

cat your-server-bundle /etc/ssl/certs/ca-certificates.crt > allcacerts.crt

...then use allcacerts.crt (or whatever you call it) as the parameter to the -CAfile option in the openssl command.

Best Answer

Related Solutions

Disable Specific Cipher Suites Apache with WHM/cPanel

Openssl p12 generation failing with CA bundle chain option

Related Question