Apache 2.4 SSL Session Cache Configuration Error: Troubleshooting SSLSessionCache Directive on Windows


3 views

When setting up Apache 2.4.2 on Windows Server 2003 R2 (32-bit), you might encounter this warning in your error logs:

[Sun Aug 05 11:52:39.546875 2012] [ssl:warn] [pid 5712:tid 348] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]

This warning appears even when you've explicitly configured the SSLSessionCache directive in your configuration file:

SSLSessionCache "shmcb:C:/Program Files/Apache Software Foundation/Apache2.4/logs/ssl_scache(512000)"

While this configuration worked perfectly in Apache 2.2.17, several factors changed in Apache 2.4:

  • New SSL module implementation (mod_ssl)
  • Different shared memory handling on Windows
  • Stricter path validation for shmcb

Here's how to systematically approach this issue:

# First, verify your SSL module is properly loaded
httpd -M | find "ssl_module"

# Check if the SSL cache directory exists and is writable
if not exist "C:\Program Files\Apache Software Foundation\Apache2.4\logs\ssl_scache" (
    mkdir "C:\Program Files\Apache Software Foundation\Apache2.4\logs\ssl_scache"
)

Try these variations of the SSLSessionCache directive:

# Option 1: Simplified path (avoid spaces)
SSLSessionCache "shmcb:C:/Apache24/logs/ssl_scache(512000)"

# Option 2: Use DBM cache instead
SSLSessionCache "dbm:C:/Apache24/logs/ssl_scache"
SSLSessionCacheTimeout 300

# Option 3: Try different directory permissions
SSLSessionCache "shmcb:C:/temp/ssl_scache(512000)"

On Windows Server 2003 R2, pay special attention to:

  • Ensure the Apache service account has full control over the cache directory
  • Verify the path doesn't contain special characters or spaces (though Apache should handle them)
  • Check for antivirus software blocking shared memory operations

Add these directives to get more detailed logging:

LogLevel debug
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLVerifyClient none
SSLVerifyDepth 10
SSLOptions +StdEnvVars +ExportCertData

After making changes:

  1. Restart Apache service
  2. Check error logs for any remaining warnings
  3. Verify SSL connections work via browser or openssl command

Test with this openssl command:

openssl s_client -connect localhost:443 -state -debug

When setting up Apache 2.4.2 on Windows Server 2003 R2 (32-bit) with PHP 5.4.5 and OpenSSL 1.0.1c, many administrators encounter this puzzling warning in the error logs:

[Sun Aug 05 11:52:39.546875 2012] [ssl:warn] [pid 5712:tid 348] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]

The first instinct is to check the httpd-ssl.conf or httpd.conf file where the SSLSessionCache directive should be properly configured. A typical working configuration looks like:

SSLSessionCache "shmcb:C:/Apache24/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300

Several factors can cause this warning even with correct configuration:

  • Directory permissions: Apache service account needs write access to the logs directory
  • Path formatting: Spaces in path names (like "Program Files") often cause issues
  • Shared memory allocation: The SHMCB session cache requires mod_socache_shmcb

Try these troubleshooting commands:

# Verify mod_socache_shmcb is loaded
httpd -M | find "socache_shmdb_module"

# Check effective configuration
httpd -S

# Test SSL configuration
openssl s_client -connect localhost:443 -state -debug

If SHMCB continues to cause problems, consider these alternatives:

# Use DBM cache instead
SSLSessionCache "dbm:C:/Apache24/logs/ssl_scache"
SSLCacheDbPath "C:/Apache24/logs/ssl_cache_db"

# Or disable cache completely (not recommended for production)
SSLSessionCache none

Ensure your virtual host configuration includes both SSL directives:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile "C:/Apache24/conf/server.crt"
    SSLCertificateKeyFile "C:/Apache24/conf/server.key"
    SSLSessionCache "shmcb:C:/Apache24/logs/ssl_scache(512000)"
</VirtualHost>

After making changes, always test your configuration with httpd -t before restarting the service.