Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to create my own CA and Server certificate for my apache server on windows.

When ever I start apache I get "Failed to configure CA certificate chain!"

The apache ssl conf settings are:

SSLProtocol -all +SSLv2
SSLCipherSuite SSLv2:+HIGH:+MEDIUM:+LOW:+EXP

SSLCertificateFile "C:/data/server/server.crt"
SSLCertificateKeyFile "c:/data/server/server.key"
SSLCertificateChainFile "c:/data/server/ca.crt"
SSLCACertificateFile "c:/data/server/ca.crt"

And I generate the key/crts based on Apache's "SSL/TLS Strong Encryption: FAQ":

Generate CA key/cert:

openssl genrsa -out ca.key 1024
openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out ca.crt

Generate server key/cert:

openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

I have been stuck on this for hours. Anyone know what I am missing? It seems to verify ok with

openssl verify -CAfile ca.crt server.crt
share|improve this question

2 Answers 2

Are you sure that certificate's paths are corrent ? It seems to me that it's not a valid windows path. Did you check apache's logs ?

share|improve this answer
    
Well I managed to trace out a number of problems. I had apache installed with no SSL and then un-installed and reinstalled the one with SSL. This corrupted the installation because uninstalling did not remove openssl.cnf and when installing it does not overwrite old conf files. I also had to change the ssl cache because ridiculously on windows apache does not support open brackets in path names so you can't specify program files (x86) for example in the ssl cache variable. Some variables need backslash and some not! After deleting everything I reinstalled and now everything works fine.... –  myforwik Sep 1 '11 at 11:53
    
Who would have thought the non ssl version would have a openssl.conf file that contains crap that is not removed when you uninstall, nor overwritten when you install the ssl version? –  myforwik Sep 1 '11 at 12:01

If it is a self-signed certificate, you should not need the SSLCertfificateChainFile directive. You don't have a real chain; you just have a root cert and a self-signed cert and no intermediate cert.

Also, your SSLProtocol lines and SSLCipherSuite are going to result in your site being a hacker's delight. You are enabling sslv2 and weak/export grade encryption ciphers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.