Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The wildcard cert is from Entrust.

It seems like it should be pretty straightforward but I haven't been able to get it to work.

This is for a new site that has not had an SSL cert associated with it before using our domain's wildcard cert.

My virtual host entry is below:

    DocumentRoot /var/www/html/sitename
    ErrorLog logs/site_log
    CustomLog logs/site_log common
    ErrorDocument 404 /customerrors/404.htm
    SSLEngine On
    SSLCertificateFile    /etc/pki/tls/certs/wildcard.crt
    SSLCertificateKeyFile /etc/pki/tls/private/wildcard.key
    SSLCertificateChainFile /etc/pki/tls/certs/chain.crt

When I try to access the site via SSL, I get the error below (pretty standard when it is using a self-signed certificate and not the one wildcard cert it should be using: uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for localhost

(Error code: sec_error_untrusted_issuer)

I've restarted apache so that isn't the issue.

share|improve this question
You've left out basically every important detail other than the fact that you're using Apache. Post what you've tried. What error message or problems you are seeing. How you're testing this. And your relevant Apache config. – MDMarra Jan 30 '12 at 18:55
Sorry, you're right about this being poorly written. I will edit and add details. – Windows Ninja Jan 30 '12 at 19:05
up vote 1 down vote accepted

As Yasith notes in his answer, you'll probably need the intermediate CA bundle in the configuration, but that's not the error you're getting, since you're apparently getting a snake-oil cert, given what you've posted.

Given the snake-oil cert, you need to check that all other SSL server virtual hosts on that IP and port 443 are turned off. I think what's happening is that you've configured the real virtual host, but didn't turn off the default configuration that comes out of the box with Apache.

share|improve this answer
What am I looking for to turn off the default configuration that comes out of the box with Apache? My apologies as I have very limited experience with LAMP...I'm a Windows guy trying to increase my Linux skillset. – Windows Ninja Jan 30 '12 at 19:33
Hmm. Try this: "grep -r 443 /etc/httpd" (or whatever the apache directory is). That will recursively look for the string "443" in there. Particularly, you'll look for other VirtualHost lines that are set for port 443. Remember that only one SSL host can listen to a given IP on port 443. What's probably happening is that Apache is reading through the config files, binds using the first configuration it sees, and is ignoring your customized virtual host. – cjc Jan 30 '12 at 19:47

There's nothing different or special about wildcard certs; you'll implement them the same as any other cert.

You'll need:

  1. mod_ssl to be enabled,
  2. Listen 443
  3. A <VirtualHost> that enables SSL:

    <VirtualHost *:443>
        SSLEngine On
        SSLCertificateFile /path/to/certificate.pem
        SSLCertificateKeyFile /path/to/private.key
        # all other config for the site; docroot, logging, access, etc
share|improve this answer
SSLCertificateKeyFile /path/to/private.key my key is in a .pem format. do i need to convert it to a .key? – t q Mar 25 '14 at 18:46
@tq The file extension doesn't matter - if it's in the proper format in a .pem file, then the directive will just work. Verify that the right thing is in there, though - it should start with -----BEGIN RSA PRIVATE KEY-----. – Shane Madden Mar 25 '14 at 22:02

Also make sure to include chain file as well.

<VirtualHost *:443>


         ErrorLog /var/log/apache2/ssl-error.log  
         LogLevel warn  
         CustomLog /var/log/apache2/ssl-access.log combined  
         ServerSignature On  

         SSLEngine On  
         SSLCertificateFile example.crt  
         SSLCertificateKeyFile example.key  
         SSLCertificateChainFile CA.crt


share|improve this answer
I added the chain file but that didn't resolve the issue. I appreciate your help as that did need to be added. – Windows Ninja Jan 30 '12 at 19:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.