I currently have a website running Ubuntu Linux and Apache 2.0 that uses an SSL certificate issued by GoDaddy. Since I've been generally unimpressed with GoDaddy, I decided to get an SSL certificate from another vendor, but I've run into problems trying to change my Apache configuration to use the new certificate.
The SSL settings for my original Apache configuration look like this:
SSLEngine on SSLProtocol all SSLCertificateFile /etc/apache2/ssl/store.fatcatsoftware.com.crt SSLCertificateKeyFile /etc/apache2/ssl/fatcatstore.key SSLCertificateChainFile /etc/apache2/ssl/gd_intermediate_bundle.crt SSLProxyEngine on
I installed the new SSL cert and changed Apache to the following:
SSLEngine on SSLProtocol all SSLCertificateFile /etc/apache2/ssl_geotrust/store.fatcatsoftware.com.crt SSLCertificateKeyFile /etc/apache2/ssl_geotrust/store.fatcatsoftware.com.key SSLProxyEngine on
I've double and triple checked all the paths, and they are all correct. However, when I restart Apache and try to load the website, I get an error from the web browser saying that the certificate was signed by an unknown authority. The really weird part though is that it also says that the certificate was issued by GoDaddy, so it's like Apache isn't even using the new certificate somehow, even though the config file is pointing right at it. I even double checked the cert file using
openssl x509 -noout -text -in server.crt, and it verifies that the certificate at that path is indeed the newly installed one.
As a further test, I tried taking the same cert/key files and installing them on my own machine running OS X. I set up the Apache config file just like I did on the actual server, and edited /etc/hosts so that typing in my domain name would redirect to localhost, to avoid having a domain name mismatch when loading the site. When I try that setup, everything works perfectly! So it certainly doesn't seem like the cert itself is at fault.
The only major differences between the two setups are a) the OS X box has Apache 2.2 instead of 2.0, and b) on the website, Apache acts as a proxy for a mongrel cluster running a Rails application behind the scenes, whereas I don't have any of that set up on my OS X machine. I've gone through all the mongrel/Rails settings I can find, but haven't found anything that seems to be related to SSL. As far as I can tell, only Apache is responsible for handling the SSL part of things.
At this point I'm totally stumped. The only thing I can think of is that there is something being cached at some level somewhere, but heck if I can find it. I even tried turning off the SSLSessionCache in Apache, but that didn't make any difference. Anyone have suggestions for new things to try?