RHEL/Apache ssl.conf configuration issue

Question

We've got multiple subdomains, each with it's own virtualhost entry in httpd.conf and (for those supporting https) in ssl.conf as well. Our main www subdomain has a GoDaddy cert associated with it. The subdomain I'm configuring right now in our dev environment ("api.bulbstorm.com") has an ssl.conf virtualhost entry that looks like this:

<VirtualHost 172.16.247.153:443>
  DocumentRoot "/var/www/api"
  ServerName api.bulbstorm.com:443
  ErrorLog logs/api-error_log
  CustomLog logs/api-access_log common
  LogLevel warn
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCertificateFile /var/www/certs/api/server.crt
  SSLCertificateKeyFile /var/www/certs/api/server.key
  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
  </Files>
  <Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
  </Directory>
  <Directory "/var/www/api">
    Options +FollowSymLinks
    RewriteEngine On
    AllowOverride All
    Order allow,deny
    Allow from all
  </Directory>
  php_value include_path "/var/www/inc"
  SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
  CustomLog logs/ssl_request_log \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

... the crt & key files in /var/www/certs/api/ were generated using openssl per instructions found here.

The api subdomain originally pointed to the godaddy cert for the www subdomain. But even though I've changed the virtualhost entry associated with the api subdomain to point to the self-signed certificate/key pair (and have restarted httpd, completely cleared browser settings related to the previous exception for the godaddy cert, etc.) browsers are still throwing warnings saying that the cert is for the www domain. When I look at the cert the browsers are pulling it looks like they're still getting the godaddy cert.

Higher up in the ssl.conf file there are these lines:

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

This cert/key pair is different than the godaddy cert/key pair referenced in the virtualhost entry for the www subdomain, which looks like this:

SSLCertificateFile /etc/www.bulbstorm.com_ssl/www.bulbstorm.com.crt
SSLCertificateKeyFile /etc/www.bulbstorm.com_ssl/www.bulbstorm.com.key
SSLCertificateChainFile /etc/www.bulbstorm.com_ssl/gd_intermediate_bundle.crt

Any light that anyone can shed on the issue I'm having will be appreciated.

Answer 1

Make sure that the api.bulbstorm.com and www.bulbstorm.com vhosts are on DIFFERENT IP addresses. Here are my vhost configs for 2 different subdomains with unique SSL certs:

/usr/local/etc/apache22/Includes/login.domain.com.ssl.conf

Listen 10.0.0.152:443

<VirtualHost 10.0.0.152:443>
ServerAdmin [email protected]
DocumentRoot /web0/cloud/login.domain.com/current
ServerName login.domain.com

ServerAlias www.login.domain.com login.domain.com


LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
TransferLog /var/log/www/login.domain.com-access_log
ErrorLog /var/log/www/login.domain.com-error_log

<DIRECTORY /web0/cloud/login.domain.com/current>
Allow from All
OPTIONS Indexes Includes ExecCGI FollowSymLinks
AllowOverride ALL
</DIRECTORY>

IndexOptions FancyIndexing

AddType application/x-httpd-php .html

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl.crt/login.domain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl.key/login.domain.com.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl.crt/comodo.ca-bundle"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


</VirtualHost>

/usr/local/etc/apache22/Includes/admin.domain.com.ssl.conf

Listen 10.0.0.151:443

<VirtualHost 10.0.0.151:443>
ServerAdmin [email protected]
DocumentRoot /web0/cloud/admin.domain.com/current
ServerName admin.domain.com

ServerAlias www.admin.domain.com admin.domain.com

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
TransferLog /var/log/www/admin.domain.com-access_log
ErrorLog /var/log/www/admin.domain.com-error_log

<DIRECTORY /web0/cloud/admin.domain.com/current>
Allow from All
OPTIONS Indexes Includes ExecCGI FollowSymLinks
AllowOverride ALL
</DIRECTORY>

IndexOptions FancyIndexing

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl.crt/admin.domain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl.key/admin.domain.com.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl.crt/comodo.ca-bundle"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


</VirtualHost>

Answer 2

As amishgeek points out, and ping confirms:

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\Owner>ping bulbstorm.com

    Pinging bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>ping www.bulbstorm.com

    Pinging www.bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>ping api.bulbstorm.com

    Pinging api.bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>

You have the same IP address for both hosts. SSL happens before host names are sent. Host names are sent to Apache through the Host: header in HTTP requests. In OpenSSL 1.0, there will be support for TLS certificates, which may help with sharing an IP, but that's another ballgame, and more Googling.

LINKS:

• A link from PositiveSSL, another SSL cert issuer
• An entry from someone troubleshooting this same issue.
• And, from the horse's mouth (Apache): http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts

WORKAROUNDS:

Per the Wikipedia entry on TLS: you should adjust your certificate to support multiple subject alternative names (GoDaddy has "UCC Certs"), or get a wildcard certificate.

Depending on your user base, you could ask users to support the CACert root certficate and get a subjectAltName certificate from them. (in fact, it looks like your current certificate has a subjectAltName for bulbstorm.com, AND www.bulbstorm.com). This saves you $70.00 per year. Put a link on your non-SSL page or on your SSL page which says something like

"Are you getting SSL browser errors? We use CACert SSL Certificates. Please follow this link to download their root certificates into your browser."

Answer 3

To answer your question at the very end, this is how to generate a self signed SSL certificate.

First, this line will generate a private key that is used to generate a certificate signing request (CSR).

openssl genrsa -des3 -out server.key 1024

You will be prompted to enter a passphrase. This passphrase will encrypt the private key. This next line will generate the CSR using your private key.

openssl req -new -key server.key -out server.csr

You will then be prompted for the following questions (and your passphrase if you chose to use one above in the generation of your private key.)

Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Edit: if you do generate a self-signed certificate for testing, the Common Name field above is where you want to put your domain (exactly as you want it, ie. with the www if you want that to be the address you use). After you've generated your CSR, you can self-sign it doing the following.

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Then you will have your private key (server.key) and your SSL certificate (server.crt) which you can install in Apache using the directives you've used above for the other certificates.

I'm not sure if this answers any of the questions regarding the apparent incorrect certificate being sent to the browser, but I would suggest perhaps removing all references to certificate files outside that VirtualHost directive to see if it still happens, since you're only really able to have one SSL host per IP address, and having multiple SSLCertificateFile directives could have an unusual effect.