Messages

@Franco, lighttpd 1.4.56 migrates from old openssl interfaces (<= openssl 1.0.1) to newer openssl certificate callback interfaces, and lighttpd 1.4.56 tries to build the certificate chain when one is not provided.  The best solution is to provide the certificate chain:

Code Select Expand


    ssl.privkey= "/etc/lighttpd/certs/www.example.com/privkey.pem"
    ssl.pemfile= "/etc/lighttpd/certs/www.example.com/fullchain.pem"


I am a lighttpd developer and am looking into the "building cert chain" issue, which was only recently reported in https://redmine.lighttpd.net/boards/2/topics/9620

If you are aware of other issues with lighttpd, please post to https://redmine.lighttpd.net/boards/2/ so that lighttpd developers are aware of the issue, and you can link to forum.opnsense.org.

This was likely fixed in lighttpd 1.4.59 (included in OpnSense 21.1.1, released 9 Feb 2021)
https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/471ab4dd5bbf752c24fdd11bfcaf163b4769cfce
https://forum.opnsense.org/index.php?topic=21386.0

If using PHP-FPM, the PHP-FPM service is started independently from lighttpd.

Check that your lighttpd config is not trying to start the PHP backends, too.  The lighttpd.conf (or include file) should not include a "bin-path" in the configuration for the PHP-FPM sockets, since on your system you want to configure lighttpd to connect to the PHP-FPM sockets, but you do not want lighttpd to attempt to create those sockets.

Another thing to check is that the user account under which lighttpd is running has permission to access the paths to the unix domain socket.

[IFF]

lighttpd developer here.   lighttpd developers generally fix issues very quickly IFF those issues are reported to the lighttpd developers at https://redmine.lighttpd.net/projects/lighttpd/issues

When configuring certificates in lighttpd, please include the intermediate certificates.  Let's Encrypt provides fullchain.pem, and that is the file that should be configured for lighttpd to use.

Code Select Expand


    ssl.privkey= "/etc/lighttpd/certs/www.example.com/privkey.pem"
    ssl.pemfile= "/etc/lighttpd/certs/www.example.com/fullchain.pem"


There is extensive documentation for how to configure lighttpd TLS modules:
https://redmine.lighttpd.net/projects/lighttpd/wiki/HowToSimpleSSL
https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL

FYI: lighttpd 1.4.44 was released a few days ago.  If you have any feedback, please post to #lighttpd on freenode or lighttpd forums https://redmine.lighttpd.net/projects/lighttpd/boards

FYI: I have been working with pkubaj, the FreeBSD package maintainer.  lighttpd 1.4.40 incorporates all existing patches added by FreeBSD except for those patches specific to the mysql auth (optional) feature.  The reason why the FreeBSD 1.4.40 patch you linked is so large is that the *generated*  Makefile is part of the patch, and that there are many removed lines due to removal of patch files that are now integrated into lighttpd 1.4.40.  [edit] The largest part of that FreeBSD patch is that pkubaj renamed one of the mysql auth patch files.

@jonkersa wrote
> Every minute the same three lines - displayed below  - are recorded in the system log.

That is possibly caused by something performing a health-check each minute by making a TCP connection and then closing it, without negotiating TLS.

As mentioned above, please add debug.log-ssl-noise = "disable" to lighttpd.conf.  That should quiet some of the warnings you are seeing.  For the last remaining warning, "SSL routines:SSL_shutdown:shutdown while in init",  a change has been pushed to lighttpd git master (post lighttpd 1.4.41) to skip SSL_shutdown() if TLS handshake has not yet completed.  https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/156bea38597ced5de7521ada2e85fb67aead21db  You'll have to backport that one-line patch to lighttpd 1.4.39, or upgrade to lighttpd 1.4.41 (highly recommended) and apply the patch.

It would be nice to get some feedback if this resolves the issue for you.   Thank you.


@franco: please review https://www.lighttpd.net/2016/7/31/1.4.41/ for security fixes and other limited changes made in lighttpd 1.4.41.  If you were planning to upgrade to lighttpd 1.4.40, you should hopefully be eager to upgrade to lighttpd 1.4.41 instead of staying on lighttpd 1.4.39 for another 6 months.  (For all the improvements in lighttpd 1.4.40, see https://www.lighttpd.net/2016/7/16/1.4.40/ )

It is fair to wait a bit to get a better sense of stability.  Overall, 1.4.40 and 1.4.41 addressed hundreds of reported issues in lighttpd, and so 1.4.41 is expected to be much better than 1.4.39.

lighttpd works on FreeBSD.  What "porting" do you mean with "I don't feel comfortable porting 1.4.41 to FreeBSD"?

FYI: it appears this added noise might be related to changes in openssl 1.0.2f.  What version of openssl are you using?

nginx addressed a similar issue in https://trac.nginx.org/nginx/ticket/901

Hi franco, et al!

I highly recommend lighttpd 1.4.41 over 1.4.40.  lighttpd 1.4.41 specifically addresses security issues like httpoxy, and bugs introduced in lighttpd 1.4.40.

*Some* of the noise can be disabled in lighttpd with debug.log-ssl-noise = "disable" added to lighttpd.conf

Had this been reported to lighttpd developers (https://redmine.lighttpd.net/projects/lighttpd/issues/new) in addition to this forum, lighttpd might have been able to work around additional openssl noise in the lighttpd 1.4.41, just released 2016-07-31.