HP OpenVMS Systems

Secure Web Server (based on Apache™)
Content starts here


HP Secure Web Server for OpenVMS (based on Apache)
Version 2.2 Release Notes


September 2011


Version 2.2 for OpenVMS Alpha, based on Apache 2.0.63


Version 2.2 for OpenVMS Integrity servers, based on Apache 2.0.63



» Downloading the Kit
» Secure Web Server Documentation
Apache Server Documentation
» Bug Fixes in Version 2.2
» New Features in Version 2.2
» Changed Features in Version 2.2
» Known Problems and Restrictions in Version 2.2
» Documentation Errata


HP is pleased to provide you with a new, HP supported version of HP Secure Web Server for OpenVMS (based on Apache). The Secure Web Server (SWS) includes Secure Sockets Layer (SSL) through mod_ssl and OpenSSL.


Downloading the Kit


The SWS for OpenVMS kit is available for the Alpha and Integrity server platforms as a compressed self-extracting file.


You can also download the SWS Version 1.3-1, based on Apache 1.3.26, which is an earlier HP supported, customer release version for OpenVMS Alpha and Integrity servers.


Fill and submit the SWS for OpenVMS registration form to download the kit.


For information about expanding and installing the kit, see the HP Secure Web Server for OpenVMS Installation and Configuration Guide.


Secure Web Server Documentation


See the Documentation Page for links to the Installation and Configuration Guide and the SSL User Guide for SWS Version 2.2.


For the SWS Version 1.3-1, documentation and compatible optional kits (CSWS_PERL, CSWS_JAVA, and CSWS_PHP) are also available from the SWS Documentation Page.


Apache Server Documentation


For more information about the Apache Server, see the Apache HTTP Server documentation.


You can also view the online Apache server documentation at:




Note: To view some of the Apache server documentation, you must enable MultiViews under <Directory "/apache$common/htdocs">.


Bug Fixes in Version 2.2


·         Fixed the issue of modperl by redirecting the console mode stdout to /Device/Nul when the server is starting up, and mirroring the UNIX Multi-Processing Modules (MPM).


·         Fixed the issue of innt_mpm by recreating the bucket allocator each time the trans pool is cleared.


·         QXCM1000879236: Fixed the issue of case-sensitive comparison in the configuration directive.

·         QXCM1000903433: Fixed the issue of Lightweight Directory Access Protocol (LDAP) authentication. The modules mod_auth_kerberos.exe and mod_auth_ldap.exe are not supported in the SWS Version 2.1.

·         QXCM1000968008: Fixed the issue of rotatelogs with error_log file.


·         QXCM1000976572: Fixed the issue of security audit messages when the SWS serve a file located in a user's public directory. This error occurs when the Uniform Resource Locator (URL) accesses a directory through the UserDir directive.


·         QXCM1001070984: Fixed the issue of Internet Protocol version 6 (IPv6).


·         CVE-2009-1891: Fixed the issue of Denial of Service or CPU consumption in the mod_deflate module.


·         CVE-2009-3095: Fixed the issue of access restriction bypass in the mod_proxy_ftp module.


·         CVE-2009-3555: Fixed the issue of renegotiation handshakes with an existing connection.


Note: The SWS_APACHE Version 2.2 is not vulnerable to the following CVEs:

(CVE-2008-2364, CVE-2009-2412, CVE-2009-3560, CVE-2009-3720, CVE-2010-0425, CVE-2010-0434, CVE-2010-1452, CVE-2010-1623).

New Features in Version 2.2

·         Based on Apache 2.0.63 from the Apache Software Foundation

·         Apache 2.2 is built using the OpenSSL Version 0.9.8h

Changed Features in Version 2.2

·         Changes required in httpd.conf when upgrading from Version 1.3-1 to Version 2.2

In SWS Version 2.2, many loadable modules are no longer loaded by default. You must uncomment the modules in httpd.conf to load them. See the file httpd-vms.conf to load other modules.


For example, to load the modules, uncomment the following lines in httpd.conf:

LoadModule osuscript_module modules/mod_osuscript.exe
LoadModule dav_module modules/mod_dav.exe
LoadModule dav_fs_module modules/mod_dav_fs.exe


The OpenVMS platform supports the following list of modules:

·         AAA

·         Cache

·         Dav

·         Echo

·         Experimental

·         Filters

·         Generators

·         HTTP

·         Loggers

·         Mappers

·         Metadata

·         Proxy

·         SSL

·         New directives

The following new directives are included in Version 2.x:

AcceptMutex vmsdlm
VMSServerTag SWS
VMSServerStartup "/apache$root/000000/apache$startup.com"
VMSServerShutdown "/apache$root/000000/apache$shutdown.com"
EnableMMAP on/off
EnableSendFile on/off

Note: In Version 2.2 and Version 2.1, by default, EnableMMAP is set to OFF. In Version 2.0,
EnableMMAP was set to ON by default.


·         Obsolete directives


The following are obsolete directives in Version 2.x:


·         Changed server process naming scheme

In Version 2.x, SWS uses a new server process naming scheme in which xxx is defined by the
VMSServerTag directive in httpd.conf.
For example:


In the old naming scheme (in SWS Version 1.3-1 and earlier)



·         Changed site-specific startup and shutdown procedure definitions

In Version 2.x, the new startup and shutdown procedure definitions are defined by the
VMSServerStartup and VMSServerShutdown directives in httpd.conf.

The old definitions (in SWS Version 1.3-1 and earlier) were defined by the

Known Problems and Restrictions in Version 2.2

·         Do not use SWS Version 2.2 with the older SWS optional kits

Do not use SWS Version 2.2 with the following optional kits. Using these kits together causes a process crash. These kits, in addition to the newer optional kits, are currently available for download from

·         PERL for OpenVMS 5.6.1 and 5.6.1-1A1
·         CSWS_PERL V2.0, 1.1, and 1.1-1
·         CSWS_PHP V1.2-1 and 1.1
·         CSWS_JAVA V2.1


SWS Version 2.2 works properly with the following new optional kits:

·         PERL for OpenVMS 5.8.6
·         CSWS_PERL V2.1
·         CSWS_PHP V1.3 and higher
·         CSWS_JAVA V3.0 and higher

·         Installing SWS Version 2.2 on an ODS-2 volume corrupts the previous SWS Version 1.3 installation

You must install the SWS Version 2.2 kit only on an ODS-5 target volume. If you install this kit on an ODS-2 volume, the installation will fail with the following error:

Destination disk is not ODS-5, aborting installation ...
%PCSI-I-PRCOUTPUT, output from subprocess follows ...

If your existing installation is SWS Version 1.3, then the failed operation will leave it in a corrupt state.

·         Language variant filename restriction

Specify language variants on an OpenVMS system in the same way as you do on a UNIX system, using multiple dots in the filename. For example, the French variant of a filename is filename.html.fr.

In the earlier versions of SWS, you could use an underscore instead of a dot before the language extension (for example, filename.html_fr).

·         WebDAV database manager type restriction

WebDAV support requires the VDBM database manager type. VDBM is the default.

To change the database manager type, set the logical name APACHE$DAV_DBM_TYPE so that it is visible to Apache, as APACHE$COMMON:[000000]LOGIN.COM.

Note: SDBM and GDBM are not supported in this kit.

·         SSLSessionCache DBM file error

Either of the SDBM or GDBM database manager types, when used, causes the following SSL session cache failure:

[Thu Apr 14 16:25:12 2005] [error] (2)no such file or
directory: Cannot create SSLSessionCache DBM file

You must use the default VDBM database manager type. To change the database manager type, set the logical name APACHE$SSL_DBM_TYPE so that it is visible to Apache, as APACHE$COMMON:[000000]LOGIN.COM.

Note: SDBM and GDBM are not supported in this kit.

·         If suEXEC is enabled in the initial configuration, SWS cannot add a node in a cluster environment

If you enable suEXEC during the initial configuration of SWS or by using Option 4 (Manage suEXEC users) from the SWS Configuration Menu, then Option 10 of the SWS configuration menu (Add a node to CSWS in a cluster environment) fails.

As a temporary workaround, use Option 4 to disable suEXEC and use Option 10 to add the node, and then use Option 4 to re-enable suEXEC.

·         Problems with APACHE$MENU.COM "Create an Apache instance" Option 2

Option 2 in APACHE$MENU.COM, called "Create an Apache instance", fails under the following circumstances:

·        Specifying a nonexistent target directory fails with the following error when the 
[.FOO] does not exist:

Root Location: dev:[APACHE.SPECIFIC.FOO]
%DCL-W-UNDSYM, undefined symbol - check validity and spelling \INDID\
%DCL-W-UNDSYM, undefined symbol - check validity and spelling \INDID\

·        Creating an instance under a name other than APACHE$WWW fails with the
following error:

[Tue Apr 19 11:20:23 2005] [error] (13)permission denied: Unable
to create input file dev:[directory.[000000]APACHE$xyz.COM

·         Cached files not served

The proxy cache feature does not serve the cached files in SWS Version 2.2.

·         AuthUserFile/AuthGroupFile Override AuthOpenVMSUser/AuthOpenVMSGroup

If the mod_auth directives AuthUserFile and AuthGroupFile are combined with the mod_auth_openvms directives AuthOpenVMSUser and AuthOpenVMSGroup, the mod_auth directives override mod_auth_openvms.

In practice, these sets of directives are not commonly used together.

·         Require user directive must specify user names in uppercase with mod_auth_openvms

The Require user directive must specify user names in uppercase when used with mod_auth_openvms.

·         ApacheBench tool fails (Integrity servers only)

On OpenVMS Integrity servers, the ApacheBench tool fails as follows:

Test aborted after 10 failures
apr_connect(): socket is already connected
(56) %SYSTEM-W-BADESCAPE, syntax
error in escape sequence

Documentation Errata


The following section describes the documentation updates and errata for HP Secure Web Server for OpenVMS (based on Apache) documentation.


In the HP Secure Web Server Based on Apache SSL User Guide the following changes should be made to these sections:

·         Configuration Options

To enable SSL:

1. Generate a self signed certificate, which is valid for 30 days. To do so, use the following certificate tool:


2. Uncomment the following directive in the APACHE$COMMON:[CONF]HTTPD.CONF file:

Include /apache$root/conf/ssl.conf

·         Disabling SSL

To disable SSL, comment the following directive in the APACHE$COMMON:[CONF]HTTPD.CONF file:

Include /apache$root/conf/ssl.conf





» Return to the Secure Web Server for OpenVMS home page