1

Are these errors related to moving a site to a new IP and keeping the same SSL CERT?

Will I need to regen/sign to fix this?

[Sun Jun 22 07:13:11.054280 2014] [mpm_worker:notice] [pid 2775:tid 2803123869632] AH00292: Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9 configured -- resuming normal operations
[Sun Jun 22 07:13:11.054328 2014] [core:notice] [pid 2775:tid 2803123869632] AH00094: Command line: '/usr/local/apache/bin/httpd -D SSL'
[Sun Jun 22 08:11:52.651176 2014] [mpm_worker:notice] [pid 2775:tid 2803123869632] AH00297: SIGUSR1 received.  Doing graceful restart
[Sun Jun 22 08:11:53.000801 2014] [ssl:warn] [pid 2775:tid 2803123869632] AH01906: web.nj.sitename.com:443:0 server certificate is a CA certificate (BasicConstraints : CA == TRUE !?)
[Sun Jun 22 08:11:53.000838 2014] [ssl:error] [pid 2775:tid 2803123869632] AH02217: ssl_stapling_init_cert: Can't retrieve issuer certificate!
[Sun Jun 22 08:11:53.000844 2014] [ssl:error] [pid 2775:tid 2803123869632] AH02567: Unable to configure certificate web.nj.sitename.com:443:0 for stapling
[Sun Jun 22 08:11:53.001476 2014] [ssl:warn] [pid 2775:tid 2803123869632] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Sun Jun 22 08:11:53.068215 2014] [mpm_worker:notice] [pid 2775:tid 2803123869632] AH00292: Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9 configured -- resuming normal operations
[Sun Jun 22 08:11:53.068256 2014] [core:notice] [pid 2775:tid 2803123869632] AH00094: Command line: '/usr/local/apache/bin/httpd -D SSL'
[Sun Jun 22 09:10:23.035351 2014] [mpm_worker:notice] [pid 2775:tid 2803123869632] AH00297: SIGUSR1 received.  Doing graceful restart
[Sun Jun 22 09:10:24.000899 2014] [ssl:warn] [pid 2775:tid 2803123869632] AH01906: web.nj.sitename.com:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Jun 22 09:10:24.000935 2014] [ssl:error] [pid 2775:tid 2803123869632] AH02217: ssl_stapling_init_cert: Can't retrieve issuer certificate!
[Sun Jun 22 09:10:24.000941 2014] [ssl:error] [pid 2775:tid 2803123869632] AH02567: Unable to configure certificate web.nj.sitename.com:443:0 for stapling
[Sun Jun 22 09:10:24.001574 2014] [ssl:warn] [pid 2775:tid 2803123869632] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Sun Jun 22 09:10:24.157294 2014] [mpm_worker:notice] [pid 2775:tid 2803123869632] AH00292: Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9 configured -- resuming normal operations
[Sun Jun 22 09:10:24.157326 2014] [core:notice] [pid 2775:tid 2803123869632] AH00094: Command line: '/usr/local/apache/bin/httpd -D SSL'

1 Answer 1

3

No, typically the SSL certificate is tied to the common name of a server, it's DNS name.
Changing the IP-address of www.example.com does not invalidate the certificate for www.example.com.

Your error message server certificate is a CA certificate suggests that you either copied the wrong certificate of misconfigured and now SSLCertificateFile points to what is actually either the SSLCertificateChainFile or the SSLCACertificateFile.

openssl x509 -in file.cert -noout -text

will display the properties of a certificate in clear text, helping you debug.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .