Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We recently switched our SSL certificates on our web hosting environment and the old certificates are still showing up on certain computers with IE installed. It works perfectly fine in both Firefox and Chrome.

On the computers that are having errors, IE is looking at the old SSL cert at *.website1.org instead of the new SSL cert at *.website2.org, thus causing security errors. We've cleared the SSL state in the internet options, removed all cookies/temp files/history/etc.., made sure the time on the computer is correct, and done just about everything we can think of to try and get these computers to view the new certificate.

That all being said, SSL Checker is looking at the old certificate as well, so that's not good obviously.

http://www.sslshopper.com/ssl-checker.html

share|improve this question

1 Answer 1

up vote 4 down vote accepted

I'd wager that it's not caching, it's Server Name Indication.

Systems supporting SNI are getting the cert from the VirtualHost, while systems that do not (likely including that SSL Checker) are getting the first certificate to load on that port - which is not this one.

Scour your config for something else loading the old certificate (it's loading before the VirtualHost that you have there). Oh, and do a full restart on the apache process (not a reload) after changing it.

share|improve this answer
    
I think you're right on track here as we are proxying all of our sites through one port on apache, but several different ports on the application server, which is the backend. I have added the full config file above. –  FAtBalloon Nov 11 '11 at 19:50
1  
@FAtBalloon Nothing else there - it'll likely be outside of this file, in either a different site file, in the main config, or in an ssl-specific config file. Running grep against the entire Apache config tree for SSLCertificateFile may be the best approach if you aren't sure where to look. –  Shane Madden Nov 11 '11 at 19:57
    
So we definitely have it in other files, as there are multiple sites using multiple SSL certs on this box. That all being said, is there a way to fix this without setting up new boxes with new IPs? ....Lots of lovely legacy stuff we're dealing with here. Love it. –  FAtBalloon Nov 11 '11 at 20:00
2  
@FAtBalloon Unfortunately, no; those clients that don't support SNI will always get the first certificate that loads on the port. Hopefully in a year or three, there will be few enough clients that it'll be practical to depend on SNI for internet-facing sites. Your best bet would be to obtain an additional IP address to bind to with the second certificate. –  Shane Madden Nov 11 '11 at 20:04
    
Thank you for your help. Very much appreciated. –  FAtBalloon Nov 11 '11 at 20:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.