Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Godaddy SSL certificate for one website on my dedicated server running Centos 5.3 / Apache 2.2.3. I have renewed certificate on Godaddy recently, however now it's showing as expired on my website. I've re-keyed certificate since and reuploaded domain.key, domain.crt and bundle.crt (example file names) files to the server, restarted apache, but the sertificate still shows as expired. I'm running out of clues.

I've tried replacing content of .crt files with jiberish and restart apache - it's still showing that certificate is expired, even though it shouldn't be picked up at all. I eventually rebooted dedicated server, still no luck. I'm using free SSL check tool http://www.digicert.com/help/ which clearly shows all the green checks except one - certificate is expired. Has someone any idea what might be causing this? Could there be some kind of caching going on here?

UPDATE: after running

openssl x509 -in domain.crt -noout -enddate

I'm getting this output:

notAfter=Jun  2 08:16:51 2013 GMT

So I asume this means I have the right certificate on the server and yet the old expired one shows on the web...

SOLVED: I did't mention this before, but it appears that the old certificate was hanging on Plesk, which was not used to create it in the first place, thus never looked at.

share|improve this question
    
I would heed ErikA's answer. Go into /etc/httpd (or whatever the Apache root is) and do something like grep -r -i ssl * just to find every config that mentions ssl. At this point, it really does sound like your Apache is pointing at the wrong cert. –  cjc Jun 6 '12 at 15:39
    
I already did that, went through every possible conf file and nothing. I've "used openssl x509 -in domain.crt -noout -enddate" which confirmed that correct certificate is on the server –  Caballero Jun 6 '12 at 15:50
    
Heh, are you looking at the right Apache instance? There's no proxy, etc.? As you've described the configuration and the file as being correct, I may look elsewhere. apachectl -S shows the right thing? –  cjc Jun 6 '12 at 16:18
    
At this point I'd say "If you stop apache, does it still say the certificate is expired" (the site is being hosted by some other server)? –  DerfK Jun 7 '12 at 2:47
    
It's definitely the right server and right instance of Apache. I've tried stopping, restarting Apache, even restarting server itself, DNS checks, everything there is on the book. I'm afraid this is a dead end for me. –  Caballero Jun 7 '12 at 8:11

4 Answers 4

Just to double-check, you could run

openssl x509 -in domain.crt -noout -enddate

against your certificate file on the server. I'd also check for correct dns resolution on your client. Also check your local host file for old entries.

share|improve this answer
    
Thanks for that. I'm getting "notAfter=Jun 2 08:16:51 2013 GMT" which I asume means that I have the right certificate on the server? My local hosts file is clean. I don't quite understand what you mean by "correct dns resolution", I mean if there was a problem with DNS wouldn't the website be down all together? –  Caballero Jun 6 '12 at 15:33

No, there's no caching going on. In short, you're not putting the new certs in the correct location. You need to look through your entire Apache config and find the correct location for your cert.

share|improve this answer
    
But I haven't even changed file locations, not even names. I've searched entire server for other possibe .crt files and came up with nothing. I have no idea where apache is pulling that old data from. I went through every single apache conf file and also there is nothing else that could cause this. –  Caballero Jun 6 '12 at 13:53

If you have the flexibility, I would try setting the loglevel for mod_ssl to a nice, decent level and see if you can't walk the steps Apache is taking as it starts.

You can setup dedicated mod_ssl logging as explained here:

http://www.modssl.org/docs/2.8/ssl_reference.html#ToC20

share|improve this answer
    
I have that running already, nothing useful whatsoever. –  Caballero Jun 6 '12 at 14:47
up vote 0 down vote accepted

The problem was caused by Plesk, which wasn't used for ages and thus never considered a part of the issue, however it somehow managed to override my manually added SSL certificate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.