Topic: mod_md with IBM HTTP Server

[sailor]

I use IBM HTTP Server 9 and 8.5. 9 is based on Apache 2.4, while 8.5 is based on 2.2. I know 2.2 is wishful, but since it's Apache, I wanted to see if I could get mod_md working on IHS 9. But I see that in the IBM modules directory there are pdb files. I guess those are debug "libraries"?

When I try to start httpd I get

httpd: Syntax error on line 158 of D:/ibm/64HTTPServer/IHS/conf/httpd.conf: Cannot load modules/mod_watchdog.so into server: The specified procedure could not be found.

LoadModule md_module modules/mod_md.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule watchdog_module modules/mod_watchdog.so


I installed the latest vc++ redis as well (and it called for a reboot of my laptop).

I copied the bin directory from the download here into my IBM bin directory while keeping the IBM files.

12/16/2022 02:22 PM <DIR> .
12/16/2022 02:22 PM <DIR> ..
12/08/2022 01:56 PM 63,488 ab.exe
12/08/2022 01:56 PM 512,000 ab.pdb
12/16/2022 01:59 PM 110,592 abs.exe
12/08/2022 01:56 PM 26,624 apache.exe
12/08/2022 01:56 PM 339,968 apache.pdb
12/16/2022 01:59 PM 43,008 ApacheMonitor.exe
12/16/2022 01:59 PM 19,456 apr_crypto_openssl-1.dll
12/16/2022 01:59 PM 31,232 apr_dbd_odbc-1.dll
12/08/2022 01:56 PM 29,696 apr_ldap-1.dll
12/08/2022 01:56 PM 372,736 apr_ldap-1.pdb
12/08/2022 01:56 PM 26,112 aprerrno.exe
12/08/2022 01:56 PM 380,928 aprerrno.pdb
12/16/2022 01:59 PM 9,192 dbmmanage.pl
12/08/2022 01:56 PM 637 gsk_envvars.bat
12/08/2022 01:56 PM 293 gskcapicmd.bat
12/08/2022 01:56 PM 753 gskcmd.bat
12/08/2022 01:56 PM 168 gskver.bat
12/08/2022 01:56 PM 49,664 htcacheclean.exe
12/08/2022 01:56 PM 454,656 htcacheclean.pdb
12/08/2022 01:56 PM 38,912 htdbm.exe
12/08/2022 01:56 PM 454,656 htdbm.pdb
12/16/2022 01:59 PM 85,504 htdigest.exe
12/08/2022 01:56 PM 37,376 htpasswd.exe
12/08/2022 01:56 PM 438,272 htpasswd.pdb
12/08/2022 01:56 PM 51,200 httpd.exe
12/08/2022 01:56 PM 479,232 httpd.pdb
12/08/2022 01:56 PM 30,720 httxt2dbm.exe
12/08/2022 01:56 PM 405,504 httxt2dbm.pdb
12/08/2022 01:56 PM 1,069 ikeyman.bat
12/16/2022 01:59 PM 55,808 jansson.dll
12/08/2022 01:56 PM 244,736 libapr-1.dll
12/08/2022 01:56 PM 1,765,376 libapr-1.pdb
12/16/2022 01:59 PM 36,864 libapriconv-1.dll
12/08/2022 01:56 PM 324,096 libaprutil-1.dll
12/08/2022 01:56 PM 1,404,928 libaprutil-1.pdb
12/16/2022 01:55 PM 3,437,568 libcrypto-1_1-x64.dll
12/16/2022 01:59 PM 515,584 libcurl.dll
12/08/2022 01:56 PM 606,720 libhttpd.dll
12/08/2022 01:56 PM 2,363,392 libhttpd.pdb
12/16/2022 01:55 PM 688,640 libssl-1_1-x64.dll
12/16/2022 01:59 PM 1,395,712 libxml2.dll
12/08/2022 01:56 PM 27,648 logresolve.exe
12/08/2022 01:56 PM 372,736 logresolve.pdb
12/08/2022 01:56 PM 33,280 lua.exe
12/08/2022 01:56 PM 230,400 lua52.dll
12/16/2022 01:59 PM 142,336 nghttp2.dll
12/16/2022 01:59 PM 550,912 openssl.exe
12/08/2022 01:56 PM 177,152 pcre.dll
12/08/2022 01:56 PM 438,272 pcre.pdb
12/16/2022 01:59 PM 341,504 pcre2-8.dll
12/08/2022 01:56 PM 47,616 postinst.exe
12/08/2022 01:56 PM 397,312 postinst.pdb
12/08/2022 01:56 PM 1,292 quickssl.bat
12/08/2022 01:56 PM 36,864 rotatelogs.exe
12/08/2022 01:56 PM 430,080 rotatelogs.pdb
12/08/2022 01:56 PM 1,982 simplepct.bat
12/08/2022 01:56 PM 29,184 SSLStash.exe
12/08/2022 01:56 PM 315,392 SSLStash.pdb
12/16/2022 01:59 PM 18,432 wintty.exe
12/04/2017 02:26 PM 418,816 yajl.dll
12/16/2022 01:59 PM 89,600 zlib1.dll
61 File(s) 21,433,882 bytes

D:\ibm\64HTTPServer\IHS\bin>httpd -V
Server version: IBM_HTTP_Server/9.0.5.14 (Win64)
Apache version: 2.4.12 (with additional fixes)
Server built: Sep 19 2022 15:23:45
Build level: gihs90/9.0.5.14-1
Server's Module Magic Number: 20120211:57
Server loaded: APR 1.5.1, APR-UTIL 1.5.2
Compiled using: APR 1.5.1, APR-UTIL 1.5.2
Architecture: 64-bit
Operating System: Windows
Server MPM: WinNT
threaded: yes (fixed thread count)
forked: no

[covener]

IHS doesn't ship mod_watchdog. You'd have to add that too (e.g. from a binary distribution of non-IHS Apache).

But higher level -- I'm skeptical mod_md will be able to accomplish much with IHS though, it depends on routines exported by mod_ssl not provided by mod_ibm_ssl (to allow certificates to be added by mod_md rather than configured statically).

I think you'd have better luck with something certbot-like + scripting using bin/gskcapmcid or using PKCS12 (supported everywere *.kdb is supported with some conditions.

https://publib.boulder.ibm.com/httpserv/ihsdiag/pkcs12.html

[sailor]

oh right, forgot about IBM SSL.so, which pretty much kills the idea.

[James Blond]

Even though I use in 99% of all cases HTTPd apache, you may take a look at Nginx Proxy Manager for SSL termination.

[sailor]

Thanks, will look into it. The other oddity with IHS is that it has a plugin to WebSphere app servers and the plugin has the app server SSL certs (the plugin has it's own keystore), though they are signed and distrubuted by WebSphere. I did see several years ago someone used NGINX instead of IHS to "proxy" the app servers.

I see there is a github, but it requires powershell.
Unfrotunately, we don't allow powershell to run.

https://github.com/sharptree/letsencrypt-ihs

I actually have batch files to use certbot and add to IHS keystore. Seems like I will have to keep working them.