<p>I have an Apache 2 installation on Debian with mod_ssl installed.  The server private key is protected by a passphase that needs to be entered on start-up.  The error and access logs are subject to logrotate on a weekly basis.  I find that Apache crashes with a passphrase-related error shortly after logrotate runs.</p>

<p>I understand that logrotate fires a SIGHUP to Apache after archiving logs and I suspect this is causing a reload and subsequent failure getting the passphrase for the server key.</p>

<p>Well, enough with my theories, here is the question:</p>

<p>Is there a "best practice" way in which to configure Apache to allow its SSL server keys to be protected by a passphrase (without storing that passphrase in a file somewhere) so that it won't crash when logrotate runs?</p>

<p>It is fine to require user input on server startup, but not restart or reload.</p>

[{'answer_id': 77928, 'author': 'Yann Ramin', 'author_id': 9167, 'author_profile': 'https://Stackoverflow.com/users/9167', 'pm_score': 2, 'selected': True, 'text': "<p>One option is to use Apache's provided log rotation tool. Its configured a bit differently than the system logrotate, but as it works with pipes, can move files around without an Apache restart.</p>\n"}, {'answer_id': 77987, 'author': 'Andrew Cholakian', 'author_id': 11105, 'author_profile': 'https://Stackoverflow.com/users/11105', 'pm_score': 2, 'selected': False, 'text': '<p>You could use <a href="http://cronolog.org/" rel="nofollow noreferrer">Cronolog</a>, which does not require a sighup. Here\'s an example:</p>\n\n<pre><code>CustomLog "| /usr/sbin/cronolog /pathtologs/%Y_%m/sitename.com-%Y%m%d.log" combined\n</code></pre>\n'}, {'answer_id': 421136, 'author': 'Derek P.', 'author_id': 45615, 'author_profile': 'https://Stackoverflow.com/users/45615', 'pm_score': 2, 'selected': False, 'text': '<p>you can also turn off the passphrase by using the following command:</p>\n\n<pre><code>openssl rsa -in example.tld.key -out example.tld.key\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/77914', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/13956/']