Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup SSL on fedora with apache.

In my vhost...

SSLCertificateFile /your/path/to/crt.crt
SSLCertificateKeyFile /your/path/to/key.key
SSLCertificateChainFile /your/path/to/DigiCertCA.crt

I had it working fine with a self signed key, but can't get it to work with the DigiCertCA crt.

When I run

service httpd restart

It fails to start. This is what I get in the logs...

[Sat Jan 29 07:57:13 2011] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suex$
[Sat Jan 29 07:57:13 2011] [error] Failed to configure CA certificate chain!

Any assistance would be really appreciated!

Thanks

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Make sure there's no missing certificates in the chain, in the SSLCertificateChainFile file there should be all the certificates in order from the CA first and then down to any intermediate certificate that was used to sign your CRT, otherwise you'll get the error.

If you don't have any intermediate certificates (looking at the Digicert page it looks like there's none http://www.digicert.com/ssl-certificate-installation-apache-ensim.htm) you should use SSLCACertificateFile instead

share|improve this answer
    
I don't know who downvoted you, this is entirely valid - the instructions even tell you to use SSLCACertificateFile. –  troyengel Jan 29 '11 at 15:29
    
Thanks. turns out it was just there was an 'X' at the bottom of one of the crt files (that I had accidentally put in the file when pressing ctrl+x to close the file. Answer accepted for just checking the chain properly. –  kron Jan 29 '11 at 15:56
    
If you think you copied and pasted correctly double check for white space. For example copying from the Verisign/Symantec the help page knowledge.verisign.com/support/ssl-certificates-support/… results in two extra spaces on each line. –  Daniel Sokolowski Dec 15 '12 at 5:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.