Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently purchased a wildcard SSL certificate for my domain, generated the CSR, and everything has been sent through OK.

My question is quite straightforward, but following this -, I can't make any sense of what to match to what.

Basically - I have 5 files:

- gs_intermediate_ca.crt
- gs_root.pem
- intermediate.pem
- *

The Values:

SSLCACertificateFile = ?
SSLCertificateChainFile = ?
SSLCertificateFile =
SSLCertificateKeyFile = ?

I'm new to this, any help would be greatly appreciated! Thanks

Edit >> Using the Answers below! Cheers,

I'm now receiving the following errors:

[error] Init: Unable to read server certificate from file /etc/apache2/domain.ssl/domain.ssl.crt/
[error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

My vHost now looks like so:

SSLCertificateFile /etc/apache2/domain.ssl/domain.ssl.crt/
SSLCertificateKeyFile /etc/apache2/domain.ssl/domain.ssl.key/
SSLCertificateChainFile /etc/apache2/domain.ssl/ca.crt
SSLCACertificateFile /etc/apache2/domain.ssl/gs_intermediate_ca.crt

Any idea where these errors can be coming from - is there a check I can run on the .crt file?

Kind regards

share|improve this question
* - is that really a file name? If so I'd remove *. – xofer Sep 29 '11 at 14:39
up vote 1 down vote accepted

That doc is definitely confusing. My guess:

SSLCACertificateFile = /path/to/gs_intermediate_ca.crt
SSLCertificateChainFile = /path/to/chain_file
SSLCertificateFile = /path/to/
SSLCertificateKeyFile = /path/to/

You should put all files outside the DocumentRoot and protect them with ownership/permissions. (I usually store certs in /etc/apache2/ssl and set ownership to root:root, permissions to 400.)

EDIT: You should download a combined chain ("bundle") file here:

Scroll to GlobalSign Root Bundle Certificates.

share|improve this answer

For SSLCertificateChainFile, you'll make a new file. Combine the intermediate and root certificates into one file formatted like this:

(intermediate certificate's base64 data here)
(root certificate's base64 data here)

And point SSLCertificateChainFile at that.

share|improve this answer
+1 Essentially the same solution, but alternate method, without a ton of edits :-) – xofer Sep 29 '11 at 17:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.