Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently purchased a wildcard SSL certificate for my domain, generated the CSR, and everything has been sent through OK.

My question is quite straightforward, but following this - http://www.globalsign.com/support/install/install_apache.php, I can't make any sense of what to match to what.

Basically - I have 5 files:

- gs_intermediate_ca.crt
- gs_root.pem
- mydomain.com.crt
- intermediate.pem
- *.mydomain.com.key

The Values:

SSLCACertificateFile = ?
SSLCertificateChainFile = ?
SSLCertificateFile = mydomain.com.crt
SSLCertificateKeyFile = ?

I'm new to this, any help would be greatly appreciated! Thanks

Edit >> Using the Answers below! Cheers,

I'm now receiving the following errors:

[error] Init: Unable to read server certificate from file /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt
[error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

My vHost now looks like so:

SSLCertificateFile /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt
SSLCertificateKeyFile /etc/apache2/domain.ssl/domain.ssl.key/domain.com.key
SSLCertificateChainFile /etc/apache2/domain.ssl/ca.crt
SSLCACertificateFile /etc/apache2/domain.ssl/gs_intermediate_ca.crt

Any idea where these errors can be coming from - is there a check I can run on the .crt file?

Kind regards

share|improve this question
    
*.mydomain.com.key - is that really a file name? If so I'd remove *. –  xofer Sep 29 '11 at 14:39
add comment

2 Answers

up vote 1 down vote accepted

That doc is definitely confusing. My guess:

SSLCACertificateFile = /path/to/gs_intermediate_ca.crt
SSLCertificateChainFile = /path/to/chain_file
SSLCertificateFile = /path/to/mydomain.com.crt
SSLCertificateKeyFile = /path/to/mydomain.com.wildcard.key

You should put all files outside the DocumentRoot and protect them with ownership/permissions. (I usually store certs in /etc/apache2/ssl and set ownership to root:root, permissions to 400.)

EDIT: You should download a combined chain ("bundle") file here: http://www.globalsign.com/support/intermediate-root-install.php

Scroll to GlobalSign Root Bundle Certificates.

share|improve this answer
add comment
SSLCertificateFile mydomain.com.crt
SSLCertificateKeyFile mydomain.com.key

For SSLCertificateChainFile, you'll make a new file. Combine the intermediate and root certificates into one file formatted like this:

-----BEGIN CERTIFICATE-----
(intermediate certificate's base64 data here)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(root certificate's base64 data here)
-----END CERTIFICATE-----

And point SSLCertificateChainFile at that.

share|improve this answer
    
+1 Essentially the same solution, but alternate method, without a ton of edits :-) –  xofer Sep 29 '11 at 17:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.