How do I install a wildcard SSL cert on a website running in a LAMP configuration on CentOS?

Question

The wildcard cert is from Entrust.

It seems like it should be pretty straightforward but I haven't been able to get it to work.

This is for a new site that has not had an SSL cert associated with it before using our domain's wildcard cert.

My virtual host entry is below:

<VirtualHost xxx.xxx.xx.xx:443>
    ServerAdmin IT@company.com
    DocumentRoot /var/www/html/sitename
    ServerName site.company.com
    ErrorLog logs/site_log
    CustomLog logs/site_log common
    ErrorDocument 404 /customerrors/404.htm
    SSLEngine On
    SSLCertificateFile    /etc/pki/tls/certs/wildcard.crt
    SSLCertificateKeyFile /etc/pki/tls/private/wildcard.key
    SSLCertificateChainFile /etc/pki/tls/certs/chain.crt
</VirtualHost>

When I try to access the site via SSL, I get the error below (pretty standard when it is using a self-signed certificate and not the one wildcard cert it should be using:

site.company.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for localhost

(Error code: sec_error_untrusted_issuer)

I've restarted apache so that isn't the issue.

Answer 1

As Yasith notes in his answer, you'll probably need the intermediate CA bundle in the configuration, but that's not the error you're getting, since you're apparently getting a snake-oil cert, given what you've posted.

Given the snake-oil cert, you need to check that all other SSL server virtual hosts on that IP and port 443 are turned off. I think what's happening is that you've configured the real virtual host, but didn't turn off the default configuration that comes out of the box with Apache.

Answer 2

There's nothing different or special about wildcard certs; you'll implement them the same as any other cert.

You'll need:

1. mod_ssl to be enabled,
2. Listen 443

3. A <VirtualHost> that enables SSL:

   <VirtualHost *:443>
       ServerName example.com
       ServerAlias www.example.com
       SSLEngine On
       SSLCertificateFile /path/to/certificate.pem
       SSLCertificateKeyFile /path/to/private.key
       # all other config for the site; docroot, logging, access, etc
   </VirtualHost>
   

Answer 3

Also make sure to include chain file as well.

<VirtualHost *:443>

         ServerAdmin admin@example.com  
         ServerName  example.com  


         ErrorLog /var/log/apache2/ssl-error.log  
         LogLevel warn  
         CustomLog /var/log/apache2/ssl-access.log combined  
         ServerSignature On  

         SSLEngine On  
         SSLCertificateFile example.crt  
         SSLCertificateKeyFile example.key  
         SSLCertificateChainFile CA.crt

</VirtualHost>