[Solved] Executing a server module with a Self-Signed Certificate on IBM i

[Taku Izumi]

Hi,

I am trying to execute a server module on my internal development IBM i using a self-signed certificate to access an external web service.
I was able to register a self-signed certificate and start the https server.
However, when I try to execute a server module from a web page, it fails with an internal server error.
The Apache log only shows the following error, and no other error information is provided:

[core:error] [pid 13231:tid 0000011A] [client 192.168.1.140:40148] ZSRV_MSG0947: Script output ends before header. File Name: LANSAWEB.PGM, referer: https://192.168.1.7/izmpgmlib/tst/xvlwebtst.html


Has anyone execute Server Module with a self-signed certificate on IBM i?

For reference, my web instance is as follows:

Code: Select all

# LANSA for the Web Apache HTTP Configuration File
LoadModule ibm_ssl_module /QSYS.LIB/QHTTPSVR.LIB/QZSRVSSL.SRVPGM
DirectoryIndex /images/index.html 
ScriptAliasMatch ^/cgi-bin/jsmadmin(.*) /QSYS.LIB/IZMJSMLIB.LIB/JSMADMIN.PGM$1
ScriptAliasMatch ^/cgi-bin/jsmproxy(.*) /QSYS.LIB/IZMJSMLIB.LIB/JSMPROXY.PGM$1
ScriptAliasMatch ^/cgi-bin/jsmdirect(.*) /QSYS.LIB/IZMJSMLIB.LIB/JSMDIRECT.PGM$1
DefaultNetCCSID 00943
DefaultFsCCSID 05035
ServerRoot /LANSA_izmpgmlib/webserver/www
DocumentRoot /LANSA_izmpgmlib/webserver/www/htdocs
ServerUserID IZMPGMLIB
# Listen *:07580
Listen *:00443
SSLEngine ON
SSLAppName IZUMI
ScriptAliasMatch ^/cgi-bin/lansaweb(.*) /QSYS.LIB/IZMCOMLIB.LIB/LANSAWEB.PGM$1
ScriptAliasMatch ^/izmpgmlib/lansaweb(.*) /QSYS.LIB/IZMCOMLIB.LIB/LANSAWEB.PGM$1
# ScriptAliasMatch ^/1234567890/lansaweb(.*) /QSYS.LIB/IZMCOMLIB.LIB/LANSAWEB.PGM$1
Alias /images /LANSA_izmpgmlib/webserver/images
Options -ExecCGI -FollowSymLinks -SymLinksIfOwnerMatch -Includes -IncludesNoExec -Indexes -MultiViews
# LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{Content-Disposition}i\" \"%{Content-Length}i\" \"%{Content-Type}i\"" combined
LogFormat "%{Cookie}n \"%r\" %t" cookie
LogFormat "%{User-agent}i" agent
LogFormat "%{Referer}i -> %U" referer
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog logs/access_log combined
LogMaint logs/access_log 7 0
LogMaint logs/error_log 7 0
SetEnvIf "User-Agent" ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0  forceresponse-1.0
AddType application/json .json
AddType text/x-component .htc
AddType audio/mp4 .m4a .mp4
Timeout 600
<Directory />
   Require all denied
</Directory>
<Directory /QSYS.LIB/IZMCOMLIB.LIB>
Require all granted
CGIConvMode BINARY
DefaultNetCCSID 1208
</Directory>
<Directory /LANSA_izmpgmlib/webserver/images>
Require all granted
</Directory>
<Directory /LANSA_izmpgmlib/webserver/www/htdocs>
Require all granted
</Directory>
LoadModule vlweb_module /QSYS.LIB/IZMCOMLIB.LIB/MOD_VLWEB.SRVPGM
<Directory /QSYS.LIB/IZMJSMLIB.LIB>
Require all granted
CGIConvMode BINARY
</Directory>
# <Directory /LANSA_izmpgmlib/webserver/ssl>
# Require all granted
# </Directory>

Regards,
Taku Izumi

[cesarrafael]

Hi Izumi,

Quick search on the web...
The issue was that the request was timing out before the script completed, due to a long-running database query.
So that generic End of script output before headers error can be caused by server timeouts as well as file permissions issues.

Maybe this helps?

[Taku Izumi]

Hi,

I contacted IBM support and asked them about the logs.
It seems that the cause of the error is that the CGI fails before calling the server module.

Also, the test program I'm using is "xvlwebtst", so the execution is simple.

This test passes when SSLEngine is Off.
I am investigating why this test fails when SSLEngine is On.

Regards,
Taku

[Taku Izumi]

Hi,

I ran https using a port other than 443 and was able to execute the server module.

Specifically, the web page and server module worked fine with the following URL:
https://192.168.1.7:7580/izmpgmlib/tst/xvlwebtst.html

Does anyone know why I get an error when using port 443?
Also, are there any issues I might encounter if I use a port other than 443?

Regards,
Taku

[Taku Izumi]

I was able to solve this issue.
I added two ports to the Web Administrator: port 80 for http and port 443 for https, and the server module call error was resolved.

スクリーンショット 2025-05-01 093234.jpeg (24.62 KiB) Viewed 31037 times

Regards,
Taku Izumi