Why you don't trust me foxy browser?

I'm looking on my blog counters and realize how lucky I'm. Recently I've found a small configuration issue in my Apache 2.4 SSL configuration. It may not affect you at all especially you have one hoop  trust chain between you and your CA. But if stars have lined up in a bad way after system re-confguration you get this:



It means you have more then one  certificates in the trust chain, so  Firefox can't build it by hjmself. There is no information about trusted certificates. Normally it means HTTP server doesn't present the full chain  but certificate and issuer information.
It's very easy to fix:
Get all your CA certificates in PEM format. Concatenate them  into  single file. Do not forget to put them in proper order. If you have chain like this:

server-cert.pem → sub-ca2-cert.pem → sub-ca1-cert.pem → root-ca.pem

then you should build your file as:

# cat sub-ca2-cert.pem cub-ca1-cert.pem root-ca.pem >/etc/httpd/conf/ssl.certs/ca-certs-chain.pem

Open your SSL Enabled site definition and put another command to the configuration

SSLCertificateChainFile /etc/httpd/conf/ssl.crt/ca-certs-chain.pem

Save configuration files.

It's right time to notice - you may have as many chains as you need and maintain two virtual sites with non-matching trust chains, just put them into right place. Check configuration syntax 

#/usr/local/apache2/bin/apachectl -t

Syntax is Ok.

With OHS severs you have no choice - full stop and start. It is fast, but it means service break. With Apache you have a neat option - graceful restart.

#/usr/local/apache2/bin/apachectl -k graceful 

 After a while all sessions will use new configuration.

Will Firefox trust you after? It depends on CA issuer notoriety, at least now you present all your credentials.

some new tricks for old dogs

Recently I've configured a small box with Fedora 21 Linux. I've done all my tasks inside the system with no issues and tested web services access outside. The real surprise was blocked access to standard http/https ports, while upper ports were quite accessible.
I'm an old dog, I'm really are. I know what it means when I see such page.

I see firewall. Especially if I can connect locally. Well, let's keep in mind systemcmd instead of good old services.

[root@fed21 ~]# systemctl status iptables
â iptables.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
[root@fed21 ~]# systemctl status ip6tablesâ ip6tables.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)
[root@fed21 ~]# sestatus
SELinux status:                 disabled
[root@fed21 ~]#

Looks pretty open, doesn't it? Actually it does not! Behold the new tricks with firewallD!
Hope I could save you couple hours and give you a hint.
So let's check firewall status:

[root@fed21 ~]# firewall-cmd --list-all
FedoraWorkstation (default, active)
  interfaces: enp0s3
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports: 1025-65535/udp 1025-65535/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

Ok, It block access to ports below 1025 (1025-65536/tcp) for interface enp0s3. Let's find how to fix it. You may use port range, I've stuck with two main ports

[root@fed21 ~]# firewall-cmd --add-port=80/tcp
success
[root@fed21 ~]# firewall-cmd --add-port=443/tcp
success

Now I have access to my browser outside the box. By the way if you want to keep this changes, I bet you do just add --permanent option.

[root@fed21 ~]# firewall-cmd --list-all
FedoraWorkstation (default, active)
  interfaces: enp0s3
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports: 1025-65535/udp 443/tcp 80/tcp 1025-65535/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:
If your Apache still not available, reload firewall parameters with command:

[root@fed21 ~]# firewall-cmd --reload
success

Hey I've just learned new tricks, what about you?

Database Smart Flash Cache

Couple weeks ago I've upgraded my laptop with Samsung EVO 850. Pretty fast 256GB SSD drive for less then hundred bucks. Men, it redefined my idea about "fast" laptops.
Just wonder how SSD cache may boost Database performance in cases when RAM is limited or.
You may find detailed post on Oracle Blogs.
Looks like  a really cool feature and even better it's available from 11.2.0.2 version.

Here you are!

After 2 weeks of wait and delivery it's there.
Still have no idea what I'll do with it, however it is nice to have pocket size Linux for 35 plus tax.
 I'll figure it out. May be I'll return to my childhood smart home experiments with new level of knowledge and equipment.