Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have signed for an SSL Certificate (Quick SSL Premium) from Geotrust by my VPS provider (1&1). I, did exactly what it is indicated here, I added all of the directives at my subdomain's Virtual Host file, but the SSL Certificate seems to be untrusted. What are the possible reasons for that?

I run Ubuntu 10.04 Lucid Lynx with Apache2 and mod_ssl enabled

share|improve this question
4  
A link would be good, so we can see what sort of "untrusted" it is. There are a variety of reasons, none of which we can detect without the URL. –  ceejayoz Mar 30 '12 at 16:50
    
Or you can do it yourself. I Chrome, you can click on the lock icon to the left of the URL bar and it will tell you much more information about the encryption being used and the reasons for any mistrust. In Firefox you can click on the area to the left of the URL bar for the same information. –  Ladadadada Mar 30 '12 at 16:54
1  
The output of openssl s_client -showcerts -CApath /etc/ssl/certs/ -connect example.com:443 would help (assuming you're on a Linux system with CA certificates in /etc/ssl/certs). –  mgorven Mar 30 '12 at 18:12
    
How exactly are you testing? –  Mike B Apr 1 '12 at 17:20
    
The errors I get from chrome are : The identity of this website has not been verified. • Server's certificate does not match the URL. • Server's certificate is not trusted. –  Paris Apr 2 '12 at 10:09
add comment

2 Answers

The possible reasons are:

  1. Client's clock set incorrectly.

  2. Client's browser does not have the CA set to be trusted.

  3. Certificate not correctly installed at the server or corresponding private key not set.

  4. Intermediate certificates required but not correctly installed at the server.

  5. Client is not trying to reach the site through a name that is listed in the certificate.

  6. Certificate was revoked or is corrupt.

If you share the URL, we can narrow the problem down immediately.

share|improve this answer
    
Awesome list. I see #4 come up a lot... –  Mike B Apr 1 '12 at 17:19
add comment

you can test your cert install against an online sslChecker:

http://www.sslshopper.com/ssl-certificate-tools.html

It will tell you immediately if something is wrong with your CA cert or immediate cert.

but the SSL Certificate seems to be untrusted. What are the possible reasons for that?

Most likely, your common name assigned at certificate signing request doesn't match the hostname you're using the cert with. You need to make sure these names match, domain and subdomain. The only way around using the same cert on multiple subdomains, is to use a wildcard cert. However, this is typically a different service than the traditional cert services, single domain certificates.

Apache CSR Example with openssl:

$ openssl req -new -newkey rsa:2048  -nodes -keyout myPrivatekey.key -out mycsr.csr -config openssl.conf
Generating a 2048 bit RSA private key
.....+++
.....................................+++
writing new private key to 'mykey.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:North Carolina
Locality Name (eg, city) []:Raleigh
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Somebody,
Inc.
Organizational Unit Name (eg, section) []:IT
Common Name (eg, YOUR name) []:test.testdomain.com (MUST MATCH HOST)
Email Address []:youremail@domain.com

Then you would send it off to your CA provider and they would generate the public, root, and intermediate certificates. Use your private key generated with the CSR.

Apache httpd.conf settings:

# Secure (SSL/TLS) connections
<IfModule ssl_module>
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM

#CA certificates for root and intermediate
SSLCACertificateFile "C:/certs/Geotrust/caroot.crt"
SSLCertificateChainFile "C:/certs/Geotrust/caIntermediate.crt"

#Generated first via openssl; Server public and private keys.
SSLCertificateFile    "C:/development/certs/Geotrust/myPublicKey.crt"
SSLCertificateKeyFile "C:/development/certs/Geotrust/myPrivatekey.key"

</IfModule>

<VirtualHost *:443>
SSLEngine On
DocumentRoot "C:/website"
ServerName test.testdomain.com
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.