Creating Stronger Self-Signed SSL Certificates For Testing

I prefer to use Google Chrome (developer channel) as my web browser and recently it began complaining about the self-signed SSL certificates I was using on a number of internal web applications I have developed. The error Chrome displayed was:

The site's security certificate is signed using a weak signature algorithm!

[snip]

I originally created the certificates using the instructions in the Apache SSL FAQ. It turns out that this results in SSL certificates that use the weaker MD5 signature hash algorithm which is the cause of the complaint. This is easily fixed by adding '-sha1' to the openssl command line when generating the certificate. Like so:

$ openssl req -new -x509 -sha1 -nodes -out server.crt -keyout server.key

SUNWapch2u, SUNWPython, and mod_python mismatched expat issue

It is fantastic that Sun have shipped a recent version of Python with Solaris 10 8/07. Unfortunately it seems the SUNWapch2u package builders aren't talking to the SUNWPython package builders which has resulted in the well documented “Expat Causing Apache Crash” issue when you try to build mod_python linked against SUNWapch2u and SUNWPython.

The mismatched expat versions used by each are:

• SUNWapch2u: expat 1.95.2
• SUNWPython: expat 1.95.8
• SUNWlexpt: expat 1.95.7 (neither apache or python use this but it is there just to add to the confusion)

In order to build a working mod_python you will have to compile your own copy of expat 1.95.8 as well as your own apache2 ensuring that you pass the “--with-expat=...” option to apache2's configure script.

I've opened a case with Sun to see if they'll fix this. Watch this blog for updates.

Update 2007.11.13: Changed SUNWapache2 to correct package name SUNWapch2u.

Update 2008.06.17:

With the release of the following Solaris 10 patches the issue describe above has been resolved:

• 120543-11 SunOS 5.10: Apache 2 Patch fixes Bug ID 6630259 "If Python and Apache 2 are used together with libexpat, httpd crashes".
• 137147-04 SunOS 5.10: libexpat patch updates libexpat to version 2.0.x.
• 121606-03 GNOME 2.6.0: Python patch fixes Bug ID 6630230 "Link Python dynamically to /usr/sfw/lib/libexpat.so".

This combination of patches allows you to build your own mod_python linked against Sun's apache2 and python 2.4. If you can wait for Bug ID 6630237 "Supply mod_python with Apache 2" to be delivered then you won't even have to do that!