Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am receiving 'Connection is Untrusted' errors when accessing my site from a browser over SSL. I can see from the details it is using the default self-signed certificate from Apache, and not the real CA-signed certificate I have installed.

In the virtual host config for the site I have:

SSLEngine on

SSLCertificateFile /etc/ssl/backup.domainname.com.crt
SSLCertificateKeyFile /etc/ssl/backup.domainname.com.key

...where domainname is the actual domain of the site. I have restarted Apache and it came back up ok.

What would be causing Apache to try and use the default self-signed certificate created when the OS was installed, rather than this real certificate specified in the virtual host config? Does it matter which directory the .crt and .key files are stored in?

share|improve this question
    
remember to use apache restart instead of graceful when working with SSL. –  anttiR Nov 7 '11 at 20:12
add comment

1 Answer

up vote 1 down vote accepted

Is it the same error or are you seeing client negotiation warnings due to a missing Intermediate cert and associated SSLCertificateChainFile entry?

Another possibility is you are using a default apache implementation that is including the old cert directives somewhere higher up in your httpd.conf or in an included conf file.

share|improve this answer
    
Thanks for the reply! I added the SSLCertificateChainFile entry but it doesn't make a difference. The certificate error detail still says 'The certificate is only valid for localhost.localdomain' as localhost.localdomain was the hostname I had set when I first installed the OS. –  dabayl Nov 7 '11 at 19:58
    
It is a default Apache implementation, and there is a separate file with SSL configuration details. I tried commenting out the references in that file to the default self-signed key & cert, but then Apache would not restart. In any case, it should be using the certificate I set for that virtual host rather than the default one right? I would have thought the default one would only be used if there wasn't a certificate specified in the virtual host config and https was being used? –  dabayl Nov 7 '11 at 20:01
1  
You'll want to replace any occurrence of your default cert directives with updated ones using your new certs. You can probably keep using the included ssl file but comment out the cert entries and replace them with the new ones. –  mahnsc Nov 7 '11 at 20:11
    
Thank you. I've just realized there can only be one SSL per IP address on the server, and not one for each name-based virtual host... I think that's what was getting me confused. I'll try it now. –  dabayl Nov 7 '11 at 20:18
    
Everything worked once I overwrote the links to default certificate in the conf.d/ssl.conf file with the links to the real one. thanks! –  dabayl Nov 7 '11 at 22:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.