Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've installed multiple SSL's on our server and we've never add any problems. But for the first time I have to create a wildcard SSL and when I add it to the virtual hosts, apache crashes ( php doesn't work ) but there is no errors logs...

Here's a typical SSL I would do in the virtual host.

<VirtualHost XXX.XX.XXX.109:443>
        ServerName www.test.ca
        ServerAlias test.ca

        DocumentRoot /home/blahblah/blahb;ah

        SSLEngine on

        SSLCertificateFile /etc/apache2/ssl/test.ca/test.ca.crt
        SSLCertificateKeyFile /etc/apache2/ssl/test.ca/test.ca.key
</VirtualHost>

That works,

Now for my wildcard SSL I did :

<VirtualHost XXX.XX.XXX.110:443>
        ServerName test2.ca
        ServerAlias *.test2.ca

        DocumentRoot /home/blah/blah/

 #       SSLEngine on

 #       SSLCertificateFile /etc/apache2/ssl/test2.ca/test2.ca.crt
 #       SSLCertificateKeyFile /etc/apache2/ssl/test2.ca/test2.ca.key

</VirtualHost>

// I commented those 3 lines because if I don't it crashes.

To create my key I did " openssl genrsa -out {domainname}.key 1024 " and to create my crt i went on trustico and filled in all my information and it generated it for me

Any ideas?

Thanks

share|improve this question
    
Anything show up in your error logs? –  larsks Nov 19 '10 at 16:20
    
Wildcards and SSL is poorly supported. The Apache folks seem to think you should never combine the two so I've stumbled on some odd behavior in that area. What kind of crash are you seeing? A hard server crash or just a config file failure? –  mfarver Nov 19 '10 at 16:21
    
I've never seen Apache act quite that way... Does adding the CA's chain file with SSLCertificateChainFile /etc/path/to/file make any difference? –  Chris S Nov 19 '10 at 16:23
    
@ larsks, there is no logs, none in the access.log and in the error.log –  Melonheadjr44 Nov 19 '10 at 16:23
    
@mfarver Apache Crashes, so when I go to like "test.ca" it brings me to google as if that site doesnt exists. We have over 300 url's on our server and once I enable the SSL they all crash –  Melonheadjr44 Nov 19 '10 at 16:25

2 Answers 2

up vote 1 down vote accepted

So it appears like there was a problem with my initial private key file. I re-created my .key my .csr and my .crt enabled it and then all sites were still working.

To make the certificate work though I did need the SSLCertificateChainFile.

Thanks everyone

share|improve this answer

Are you using SubjectAltName attribute in your SSL Certs?

If so, then I don't see

UseCanonicalName On

in your virtual host directive. I assume you have a separate virtual host directive for each ServerName directive within too.

share|improve this answer
    
Trustico made the CRT for me, with the information I provided so I am not sure if the SubjectAltName is used. Should I try UseCanonicalName On? And yes each different IP has a different virtual host. –  Melonheadjr44 Nov 19 '10 at 17:26
    
"each different IP" If you have a separate IP for each FQDN, then why are you using wild card certs? (cost savings or something?) Yes, I believe you need the UseCanonicalName On directive. –  Kilo Nov 19 '10 at 17:42
    
Well, we host many clients. So test1.com will have a normal SSL ( no wildcard ) and test2.com could have a wildcard SSL. –  Melonheadjr44 Nov 19 '10 at 18:10
    
just tried adding UseCanonicalName On and it still crashed all sites on the server –  Melonheadjr44 Nov 19 '10 at 18:14
    
Do you know if your certs need intermediate certs? The example given shows no intermediate certs and many 'new comers' to the SSL cert offering market tend to require this. Trustico mentions GeoTrust and Verisign so it would appear they are an intermediary. Post a https URL that is protected by one of their certs and I'll examine it for you (if you have one). –  Kilo Nov 19 '10 at 23:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.