3

The wildcard cert is from Entrust.

It seems like it should be pretty straightforward but I haven't been able to get it to work.

This is for a new site that has not had an SSL cert associated with it before using our domain's wildcard cert.

My virtual host entry is below:

<VirtualHost xxx.xxx.xx.xx:443>
    ServerAdmin [email protected]
    DocumentRoot /var/www/html/sitename
    ServerName site.company.com
    ErrorLog logs/site_log
    CustomLog logs/site_log common
    ErrorDocument 404 /customerrors/404.htm
    SSLEngine On
    SSLCertificateFile    /etc/pki/tls/certs/wildcard.crt
    SSLCertificateKeyFile /etc/pki/tls/private/wildcard.key
    SSLCertificateChainFile /etc/pki/tls/certs/chain.crt
</VirtualHost>

When I try to access the site via SSL, I get the error below (pretty standard when it is using a self-signed certificate and not the one wildcard cert it should be using:

site.company.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for localhost

(Error code: sec_error_untrusted_issuer)

I've restarted apache so that isn't the issue.

2
  • 1
    You've left out basically every important detail other than the fact that you're using Apache. Post what you've tried. What error message or problems you are seeing. How you're testing this. And your relevant Apache config.
    – MDMarra
    Jan 30, 2012 at 18:55
  • Sorry, you're right about this being poorly written. I will edit and add details. Jan 30, 2012 at 19:05

4 Answers 4

1

As Yasith notes in his answer, you'll probably need the intermediate CA bundle in the configuration, but that's not the error you're getting, since you're apparently getting a snake-oil cert, given what you've posted.

Given the snake-oil cert, you need to check that all other SSL server virtual hosts on that IP and port 443 are turned off. I think what's happening is that you've configured the real virtual host, but didn't turn off the default configuration that comes out of the box with Apache.

2
  • What am I looking for to turn off the default configuration that comes out of the box with Apache? My apologies as I have very limited experience with LAMP...I'm a Windows guy trying to increase my Linux skillset. Jan 30, 2012 at 19:33
  • Hmm. Try this: "grep -r 443 /etc/httpd" (or whatever the apache directory is). That will recursively look for the string "443" in there. Particularly, you'll look for other VirtualHost lines that are set for port 443. Remember that only one SSL host can listen to a given IP on port 443. What's probably happening is that Apache is reading through the config files, binds using the first configuration it sees, and is ignoring your customized virtual host.
    – cjc
    Jan 30, 2012 at 19:47
3

There's nothing different or special about wildcard certs; you'll implement them the same as any other cert.

You'll need:

  1. mod_ssl to be enabled,
  2. Listen 443
  3. A <VirtualHost> that enables SSL:

    <VirtualHost *:443>
        ServerName example.com
        ServerAlias www.example.com
        SSLEngine On
        SSLCertificateFile /path/to/certificate.pem
        SSLCertificateKeyFile /path/to/private.key
        # all other config for the site; docroot, logging, access, etc
    </VirtualHost>
    
2
  • SSLCertificateKeyFile /path/to/private.key my key is in a .pem format. do i need to convert it to a .key?
    – t q
    Mar 25, 2014 at 18:46
  • @tq The file extension doesn't matter - if it's in the proper format in a .pem file, then the directive will just work. Verify that the right thing is in there, though - it should start with -----BEGIN RSA PRIVATE KEY-----. Mar 25, 2014 at 22:02
1
<VirtualHost *:443>
     SSLEngine On
     SSLCertificateFile /etc/pki/tls/certs/example.com.crt
     SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
     SSLCACertificateFile /etc/pki/tls/certs/root-certificate.crt  #If using a self-signed certificate or a root certificate provided by ca-certificates, omit this line

     ServerAdmin [email protected]
     ServerName www.example.com
     DocumentRoot /var/www/example.com/public_html/
     ErrorLog /var/www/example.com/logs/error.log
     CustomLog /var/www/example.com/logs/access.log combined
</VirtualHost>
0

Also make sure to include chain file as well.


<VirtualHost *:443>

         ServerAdmin [email protected]  
         ServerName  example.com  


         ErrorLog /var/log/apache2/ssl-error.log  
         LogLevel warn  
         CustomLog /var/log/apache2/ssl-access.log combined  
         ServerSignature On  

         SSLEngine On  
         SSLCertificateFile example.crt  
         SSLCertificateKeyFile example.key  
         SSLCertificateChainFile CA.crt

</VirtualHost>


1
  • I added the chain file but that didn't resolve the issue. I appreciate your help as that did need to be added. Jan 30, 2012 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .