2

I currently have a website running Ubuntu Linux and Apache 2.0 that uses an SSL certificate issued by GoDaddy. Since I've been generally unimpressed with GoDaddy, I decided to get an SSL certificate from another vendor, but I've run into problems trying to change my Apache configuration to use the new certificate.

The SSL settings for my original Apache configuration look like this:

SSLEngine on
SSLProtocol all
SSLCertificateFile /etc/apache2/ssl/store.fatcatsoftware.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/fatcatstore.key
SSLCertificateChainFile /etc/apache2/ssl/gd_intermediate_bundle.crt
SSLProxyEngine on

I installed the new SSL cert and changed Apache to the following:

SSLEngine on
SSLProtocol all
SSLCertificateFile /etc/apache2/ssl_geotrust/store.fatcatsoftware.com.crt
SSLCertificateKeyFile /etc/apache2/ssl_geotrust/store.fatcatsoftware.com.key
SSLProxyEngine on

I've double and triple checked all the paths, and they are all correct. However, when I restart Apache and try to load the website, I get an error from the web browser saying that the certificate was signed by an unknown authority. The really weird part though is that it also says that the certificate was issued by GoDaddy, so it's like Apache isn't even using the new certificate somehow, even though the config file is pointing right at it. I even double checked the cert file using openssl x509 -noout -text -in server.crt, and it verifies that the certificate at that path is indeed the newly installed one.

As a further test, I tried taking the same cert/key files and installing them on my own machine running OS X. I set up the Apache config file just like I did on the actual server, and edited /etc/hosts so that typing in my domain name would redirect to localhost, to avoid having a domain name mismatch when loading the site. When I try that setup, everything works perfectly! So it certainly doesn't seem like the cert itself is at fault.

The only major differences between the two setups are a) the OS X box has Apache 2.2 instead of 2.0, and b) on the website, Apache acts as a proxy for a mongrel cluster running a Rails application behind the scenes, whereas I don't have any of that set up on my OS X machine. I've gone through all the mongrel/Rails settings I can find, but haven't found anything that seems to be related to SSL. As far as I can tell, only Apache is responsible for handling the SSL part of things.

At this point I'm totally stumped. The only thing I can think of is that there is something being cached at some level somewhere, but heck if I can find it. I even tried turning off the SSLSessionCache in Apache, but that didn't make any difference. Anyone have suggestions for new things to try?

2 Answers 2

6

Triple check that you don't have another virtual host somewhere in the config files that is stil using the old cert. Especially check various include directories (/etc/apache.d) where you might have configured the virtual host and forgotten about it.

1
  • Yes, that was it! I had actually also changed the SSL config on the other virtual host to point to the new cert also, but I guess for some reason that still doesn't work properly. Disabling the other virtual host altogether did the trick though. Jan 7, 2010 at 21:16
1

Also triple check that you do not have another httpd.conf file somewhere that is the one that apache is really looking at, especially if you aren't the one who set up the system in the first place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .