Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having trouble generating a "trusted" certificate with OpenSSL. When I navigate to any page on my server using "https://", I get an "Untrusted Connection" page. Firefox gives me the "sec_error_untrusted_issuer" error.

I am running CentOS 5/Apache and here is my output of what version of OpenSSL is installed:

openssl-devel-0.9.8e-22.el5_8.3
openssl-0.9.8e-22.el5_8.3

Here is my Apache configuration:

<VirtualHost *:433>
    DocumentRoot "var/www/html"
    ServerName mydomain.com
    ServerAlias www.mydomain.com
    SSLEngine On
    SSLCertificateFile /home/user/mydomain.com.crt
    SSLCertificateKeyFile /home/user/mydomain.com.key
    SSLCertificateChainFile /home/user/gd_bundle.crt
</VirtualHost>

I have opened port 443 with iptables, I have restarted Apache (no errors), and I have updated OpenSSL (via yum) to the latest version.

Thank you for any input.

share|improve this question
2  
So how did you generate that certificate? How did you tell Firefox to trust your (selv-signed?) certificate? And why don`t you use 442? –  Nils May 29 '12 at 20:33
2  
isn't it 443? (we get there eventually on SF;-) –  Tom H May 29 '12 at 20:36
    
Yes, it's 443. Gah, that was so simple I can't believe I missed it. Can one of you put the 443 port as an answer so I can accept it? It definately works. Thanks! –  user1062058 May 29 '12 at 20:40

1 Answer 1

up vote 1 down vote accepted

There is a port typo in the httpd.conf given;

 <VirtualHost *:433>  

should be

 <VirtualHost *:443>

1) In order for your browser to trust your certificate, you would first need to create a Certificate authority (CA) key-pair and certificate.

You would then use the CA key to sign your SSL certificate, and then import the CA certificate into your browser trusted CA bundle store.

Then your browser would trust the certificate implicitly because it trusts the CA (because you imported it)

2) I think it would be possible to explicitly tell your browser to trust the self-signed certificate. But yet again, you would need to read the instructions relating to your browser and platform to accept self-signed keys.

3) if you have bought a SSL cert from a provider, then you would have to provide more details of the steps you have taken to make progress.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.