I can’t accept this is happening, but it is true.

   On December 20th, Reuters broke “Exclusive: Secret contract tied NSA and security industry pioneer“. On December 23rd, Mikko Hypponen wrote “An Open Letter to the Chiefs of EMC and RSA“.

   I can’t accept this is happening, but Mikko wrote such a letter shows us the article is almost true. For NSA, it might be their regular jobs. But for RSA, what a shame!! Of course, we should read not only Reuters side articles but also the opposite side ones like RSA RESPONSE TO MEDIA CLAIMS REGARDING NSA RELATIONSHIP.

   It is a sad fact that RSA’s credibility was destroyed.

About the ca-bundle.crt of WordPress3.7.x.

Update information      Edit(2014.Jan.30)    Edit2(May.6)    Edit3(Jun.22)

   I wrote something about the ca-bundle.crt of WordPress3.7.x on the post.

   About it, Oiram gave me A useful information. If you get the same issue “Warning! Problem updating https://SITENAME. Your server may not be able to connect to sites running on it. Error message: SSL certificate problem: self signed certificate in certificate chain.“, read the article “Error upgrading WordPress (SSL)”, and do his workaround.

   Thinking back now, in my case, there were some differences from his case. Even now, I do not use his workaround. My SSL certificate system works well after updating to WordPress3.7.1. This time updating did not give me any warnings.

   My server environment is very unique, so, I might have got the issue was slightly different from his.

   Still now, I have two questions.

  1. Why did WordPress ver.3.7 give me the warning about one site only in spite of there were a parent and three child sites on the same WordPress multisite?
    About the setting of the ca-bundle.crt, I found out in the class-http.php. This should have the same effect on all of my sites. Why did one site only have the warning?
  2. Do I need to use Oiram’s workaround though my SSL system works well?

Edit(2014.Jan.30):
   Since January 3rd, I cannot access to the Oiram’s site. For a few people googling by the word “ca-bundle.crt” and reaching here, I uploaded the PDF version of Oiram’s workaround. 「Error upgrading WordPress (SSL)

Edit2(May.6):
   Today, I can access to the the Oiram’s site after a very long interval.

Edit3(Jun.22):
   I wrote an article The solution of “SSL3_READ_BYTES:sslv3 alert handshake failure” on WordPress.

WordPress: Administration Over SSL #3

   When I activated the Administration Over SSL, I didn’t set “define( ‘FORCE_SSL_ADMIN’, true );” because at that moment I used a laptop pc (LaVie PC-LC5505D) as the server and it was already slow.

   Today, I had an update message about the plugin Ajax Edit Comments Version 5.0.30.0 and the Changelog read:

Fixing SSL error when FORCE_SSL_ADMIN is set to true. See trac ticket: http://buddypress.trac.wordpress.org/ticket/4761

   That made me remember the setting of the Administration Over SSL.

   I opened my wp-config.php and commented out the line “define( ‘FORCE_SSL_LOGIN’, true );” under which I added the line “define( ‘FORCE_SSL_ADMIN’, true );”. Saved and closed the wp-config.php.

   After this, when I access all the administration area of my WordPress, I need my own certificate because the WordPress works over SSL. Fortunately, I don’t feel the server response is slower. How about you?

   By the way, I also had an update message about the phpMyAdmin 4.0.6, so I used this opportunity to update it.

Updating to PHP5.5.3.

   At Aug-21 17:44:24UTC, they released PHP5.5.3.

   Acoording to the ChangeLog, they fixed UMR(unInitialized Memory Read) in fix for CVE-2013-4248. A fix for CVE-2013-4248 again?

   Anyway, I downloaded a Thread Safe version php-5.5.3-Win32-VC11-x86.zip for my server (Windows7HP+SP1(x86)). It requires VC11. If you don’t have VC11 on your Windows, you must install vcredist_x__.exe before the PHP configuration.

   As the official PHP binary includes php5apache2_4.dll, I extract the zip archive and replace all PHP5.5.2 files with all PHP5.5.3 files except my php.ini. Then, I restart my Apache. That’s it.

   If you need how to configure PHP5.5, please see the post. It is for a mbstrings user, but the information gives some help for you.

Updating to PHP5.5.2.

   At Aug-16 02:13:06UTC, they released PHP5.5.2. So, I downloaded a Thread Safe version php-5.5.2-Win32-VC11-x86.zip for my server (Windows7HP+SP1(x86)). It requires VC11. If you don’t have VC11 on your Windows, you must install vcredist_x__.exe before the PHP configuration.

   Acoording to the ChangeLog, it has some bug fixes and includes the patch for CVE-2013-4248.

   The new php.ini-production has two difference from the php.ini-production of version 5.5.1.
   The line “;extension=php_zip.dll” doesn’t exist anymore.
   Edit typos: mssql.compatability_mode = Off —> mssql.compatibility_mode = Off

   As the official PHP binary includes php5apache2_4.dll, I extract the zip archive and replace all PHP5.5.1 files with all PHP5.5.2 files except my php.ini. Then, I restart my Apache. That’s it.

   If you need how to configure PHP5.5, please see the post. It is for a mbstrings user, but the information gives some help for you.

To create a Wamp-like Web Server in Windows7-#4.

   Continued from my last post.

Enabled SSL.

  1. Copy cacert.pem, server.crt, server.key to the Apache conf directory.

    If you need how to make these three files, please see WordPress: Administration Over SSL #1.

    I think a cmd.exe on a Windows7 recognizes both slashes(/) and backslashes(\) in a openssl.cnf. Maybe, you need not use “\\” in the openssl.cnf when you customize it. On a Windows7, you can see a openssl.cnf as a openssl.conf instead of openssl, a file type “SpeedDial”. Ha-ha-ha.

  2. Customize the file httpd-ssl.conf in the Apache extra conf directory.
    If you need how to customize, please see WordPress: Administration Over SSL #1.
  3. Customize the file httpd.conf.
    If you need how to customize, please see WordPress: Administration Over SSL #1.
  4. Control Panel >> Administrative tools >> Windows Firewall with Advanced Security >> Inbound Rules
    Add the port 443 to “Apache HTTP Server”.

    By the way, if you accept about the port alert from your Windows Firewall, the rules are created automatically. But they seem too looser for the Web Server wares. At “Windows Firewall with Advanced Security” you can strictly set up them. So, you should use this advanced feature.

  5. Restart the Apache.

   Mission Complete!

WordPress: Administration Over SSL #2

   Now, WordPress setting. As I had no experience about this, it was a worry to me, but, no problem. I found HOW TO do it.

   I set “define(‘FORCE_SSL_LOGIN’, true);” in my wp-config.php. I don’t use “define(‘FORCE_SSL_ADMIN’, true);” because my server is already slow (^^;).

   I access my log-in page. Immediately, I have a message “Multisite only works without the port number in the URL.”. OOPS!! I would have wanted to use port xxxxx instead of SSL well-known port. I have no choice, then I replace port xxxxx with the default. Well, I’ve got SSL login to my WordPress.

   I must learn about rewrite rule or so. But now, I am satisfied by this level.

WordPress: Administration Over SSL #1

Update information      Edit(Jun.19)

   As I wrote before, my WordPress Login, I can only do via my home LAN because of my access control. But, honestly, it’s inconvenient very much (-_-;). So, I want I can log in my WordPress by my mobile PC. However, to transmit an unencrypted password goes against my policy.

   So, I decide to support SSL on my server (WindowsXP SP3 (x86)) again. Actually, as Apache 2.4 win32 binaries is built with apr-1.4.6 apr-util-1.4.1 apr-iconv-1.2.1 openssl-1.0.1e zlib-1.2.7 pcre-8.32 libxml2-2.9.0 lua-5.1.5 expat-2.1.0, it includes openssl.exe, openssl.cnf and other openssl files. The user is only me and the feature I need is only to log in my WordPress. Therefore, I need a private CA instead of the provider CA, like as VeriSign‘s.

   First, I make cakey.pem and cacert.pem. Usually, we use CA.pl on windows. But, Apache 2.4 win32 binaries doesn’t have CA.pl, so I use openssl.exe directly as command line tool. You can find HOW TO on the document page.

  1. Make a directory myCA somewhere in the server. Under the myCA, make directories private and newcerts, an empty text file index.txt. Actually, I made the myCA directory on a removable media. Because it’s convenient for moving my_ca.crt and clientcert.p12 to my client PC and secure if I remove it from my server when not using.
  2. The file openssl.cnf exists in the Apache conf directory. On WindowsXP, you see openssl.cnf as openssl, a file type “SpeedDial”. Open the file and modify. This modification is absolutely necessary on WindowsXP. If not, you will have an error like the below. MS new cmd.exe can use both “/” and “\” as directory separators. But old cmd.exe can’t use “/”. Besides, to escape \ character is required in the file. So, you need “\\”.

    Error opening CA private key ./myCA/private/cakey.pem
    3464:error:02001003:system library:fopen:No such process:.\crypto\bio\bss_file.c:398:fopen(‘./myCA/private/cakey.pem’,’rb’)
    3464:error:20074002:BIO routines:FILE_CTRL:system lib:.\crypto\bio\bss_file.c:400:
    unable to load CA private key

    Modification of openssl.cnf:

         RANDFILE = $ENV::HOME/.rnd —> RANDFILE = $ENV::HOME\\.rnd
         #oid_file = $ENV::HOME/.oid —> #oid_file = $ENV::HOME\\.oid

         dir = ./demoCA —> dir = (drive xx):\\myCA   (Exact path required)
         certs = $dir/certs —> certs = $dir\\certs
         crl_dir = $dir/crl —> crl_dir = $dir\\crl
         database = $dir/index.txt —> database = $dir\\index.txt

         new_certs_dir = $dir/newcerts —> new_certs_dir = $dir\\newcerts

         certificate = $dir/cacert.pem —> certificate = $dir\\cacert.pem
         serial = $dir/serial —> serial = $dir\\serial
         crlnumber = $dir/crlnumber —> crlnumber = $dir\\crlnumber

         crl = $dir/crl.pem —> crl = $dir\\crl.pem
         private_key = $dir/private/cakey.pem —> private_key = $dir\\private\\cakey.pem
         RANDFILE = $dir/private/.rand —> RANDFILE = $dir\\private\\.rand

    If you use TSA (Time Stamping Authority), you have to make the same modifications for the TSA area.

    As I use 2048 bits as default, I also modify the next.
         default_bits = 1024 —> default_bits = 2048

    By the way, I don’t add (drive x):\(Apache bin dir) to the path environment variable. If you feel better to do that, please do so though I don’t like it.

  3. Run cmd.exe
         >cd (drive xx):\myCA
         >copy index.txt+   (as a replacement for UNIX touch command)
         >echo 01 > serial   (a serial file contains a valid serial number is required)
         >(drive x):\(Apache bin dir)\openssl req -new -keyout private\cakey.pem -out careq.pem -config (drive x):\(Apache conf dir)\openssl.cnf

         Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for cakey.pem)
         Verifying – Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for cakey.pem)

         Country Name:JP
         State or Province Name:FUKUOKA
         Locality Name:FUKUOKA
         Organization Name:o6asan’s Web Site
         Organizational Unit Name:myCA
         Common Name:o6asan.com
         Email Address:My mail address

         A challenge password: blank
         An optional company name: blank

  4. Selfsign a certificate request, using CA extensions:
         >(drive x):\(Apache bin dir)\openssl ca -config (drive x):\(Apache conf dir)\openssl.cnf -selfsign -in careq.pem -extensions v3_ca -out cacert.pem

         Enter pass phrase for (drive xx):\myCA\private\cakey.pem: xxxxxxxxxxxxxxxx   (pass phrase for cakey.pem)

         Sign the certificate? [y/n]: y
         1 out of 1 certificate requests certified, commit? [y/n] y

         >copy cacert.pem (drive x):\(Apache conf dir)   (cacert.pem for Server use)
         >copy cacert.pem my_ca.crt   (my_ca.crt for Client use)

   Second, I make server.key and server.crt.

  1.      >(drive x):\(Apache bin dir)\openssl req -new -keyout server.key -out server.csr -config (drive x):\(Apache conf dir)\openssl.cnf

         Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for server.key)
         Verifying – Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for server.key)

         Country Name:JP
         State or Province Name:FUKUOKA
         Locality Name:FUKUOKA
         Organization Name:o6asan’s Web Site
         Organizational Unit Name:WordPress
         Common Name:o6asan.com
         Email Address:My mail address

         A challenge password: blank
         An optional company name: blank

  2. Sign a certificate request:
         >(drive x):\(Apache bin dir)\openssl ca -in server.csr -out server.crt -config (drive x):\(Apache conf dir)\openssl.cnf

         Enter pass phrase for (drive xx):\myCA\private\cakey.pem: xxxxxxxxxxxxxxxx   (pass phrase for cakey.pem)

         Sign the certificate? [y/n]: y
         1 out of 1 certificate requests certified, commit? [y/n] y

         >copy server.crt (drive x):\(Apache conf dir)

  3. As Win32 doesn’t support SSLPassPhraseDialog builtin, I need to remove the encryption from my server.key because of getting rid of an error at Apache startup time (PDF version).

         >copy server.key cp_server.key
         >(drive x):\(Apache bin dir)\openssl rsa <cp_server.key> (drive x):\(Apache conf dir)\server.key

         Enter pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for server.key)

   Third, I make clientcert.p12.

  1.      >(drive x):\(Apache bin dir)\openssl req -new -keyout client.key -out client.csr -config (drive x):\(Apache conf dir)\openssl.cnf

         Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for client.key)
         Verifying – Enter PEM pass phrase: xxxxxxxxxxxxxxxx   (pass phrase for client.key)

         Country Name:JP
         State or Province Name:FUKUOKA
         Locality Name:FUKUOKA
         Organization Name:o6asan’s Web Site
         Organizational Unit Name:Administration
         Common Name:o6asan
         Email Address:My mail address

         A challenge password: blank
         An optional company name: blank

  2.      >(drive x):\(Apache bin dir)\openssl ca -in client.csr -out client.crt -config (drive x):\(Apache conf dir)\openssl.cnf

         Enter pass phrase for (drive xx):\myCA\private\cakey.pem: xxxxxxxxxxxxxxxx   (pass phrase for cakey.pem)

         Sign the certificate? [y/n]: y
         1 out of 1 certificate requests certified, commit? [y/n] y

  3. Make pkcs12 format client file.
         >(drive x):\(Apache bin dir)\openssl pkcs12 -export -in client.crt -inkey client.key -out clientcert.p12

         Enter pass phrase for client.key: xxxxxxxxxxxxxxxx   (pass phrase for client.key)
         Enter Export Password: xxxxxxxxxxxxxxxx   (password for client PC use)
         Verifying – Enter Export Password: xxxxxxxxxxxxxxxx   (password for client PC use)

    Close cmd.exe

   Now, I have cacert.pem, server.crt, server.key in my Apache conf directory, and, my_ca.crt and clientcert.p12 for my client PC on the removable media. These five files I only need to support SSL on my server.

   I uncomment the following lines in my current httpd.conf.

  • LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
  • LoadModule ssl_module modules/mod_ssl.so
  • Include conf/extra/httpd-ssl.conf

   I modify the file httpd-ssl.conf which exists in the Apache extra conf directory.
     Listen 443 —> Listen xxxxx   (If you leave the default, it’s no problem.)

     <VirtualHost _default_:443> —> <VirtualHost _default_:xxxxx>
     DocumentRoot “c:/Apache24/htdocs” —> DocumentRoot “my document root”
     ServerName www.example.com:443 —> ServerName o6asan.com:xxxxx
     ServerAdmin admin@example.com —> ServerAdmin My mail address
     ErrorLog “c:/Apache24/logs/error.log”
     —> ErrorLog “|bin/rotatelogs.exe -l -f logs/error.%Y.%m.%d 86400″ (my ErrorLog format)
     TransferLog “c:/Apache24/logs/access.log”
     —> TransferLog “|bin/rotatelogs.exe -l -f logs/access.%Y.%m.%d 86400″ (my CustomLog format)

     #SSLCACertificateFile “c:/Apache24/conf/ssl.crt/ca-bundle.crt”
     —> SSLCACertificateFile “C:/Apache24/conf/cacert.pem”

     #SSLVerifyClient require —> SSLVerifyClient require
     #SSLVerifyDepth 10 —> SSLVerifyDepth 10 SSLVerifyDepth 1

     <Directory “c:/Apache24/cgi-bin”> —> <Directory “my cgi-bin directory”>

   Restart My Apache.
   Install my_ca.crt and clientcert.p12 to my client PC Web browser.

   The remaining is the settings for my WordPress. Whew!

Edit(Jun.19):
   When I first logged in my WordPress over SSL, I had the message “Multisite only works without the port number in the URL”. I had no choice, then I replaced port xxxxx with the default. (^^;)