Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've spent hours and hours researching this problem and before I do something drastic like redoing all of the relevant configs I thought I'd ask for help.

I'm a student sys-admin at a college and we've been having a problem with a website we're hosting. Visiting the website gives a "security certificate not trusted warning". Viewing the certificate shows it is the default, self-signed server cert, not the one we purchased and that is supposed to get served.

This problem first came to our attention when we tried to switch this domain from pointing to a "regular" site to a new Drupal site. Originally domain.flavor.name.edu and domain.name.edu both pointed to the same regular site. We wanted to keep domain.flavor.name.edu pointing to the old and point domain.name.edu to the new Drupal site, so I deleted the domain.name.edu.conf files out of vhosts.d. Understandably, the SSL errors came but since I had never seen any of our other sites with valid SSL I didn't think much of it. However, the boss insists that the SSL was working fine before. To backtrack I moved back the files that I had removed, but I don't think that solved the problem (sorry I'm a bit hazy here, it's been several weeks since this first happened, and the other sys-admin may have changed some things too). Anyway maybe that means the problem is really just with the .confs in vhosts.d since domain.name.edu is still pointing to the new Drupal site and not back to the old. I have done several restarts of apache, both graceful and regular restart.

The server (running Gentoo) is set up with Name Based Virtual Hosts, all on the same IP. As I understand, we should be able to have multiple sites with different SSL certs through SNI. The error_log confirms that we have SNI set up (Init: Name-based SSL virtual hosts only work for ...).

in /etc/apache2/vhosts.d/ there's:

00_default_vhost.conf
00_ssl_domain.name.edu.conf
05_default_ssl_vhost.conf
blah blah more .confs

I remember reading there can be some kind of conflicts if Apache reads the wrong .conf in vhosts.d first and it does whatever's there without looking further or something of the sort but I think the numbers are supposed to take care of that, order wise 00_ssl_domain.name.edu should come before the default.

In 00_ssl_domain.name.edu.conf
...
SSLCertificateFiles /etc/ssl/apache2/domain.name.edu.crt
...
SSLCertificateKeyFile /etc/ssl/apache2/domain.name.edu.key
...
SSLCertificateChainFile /etc/ssl/apache2/geotrust.crt
...
Both the certificate and intermediate should be good, I even dug up the email from earlier this spring when we got the certificates and recopied them in. openssl verify -CAfile geotrust.crt domain.name.edu.crt returns OK.

Maybe this is a Drupal problem, maybe I've botched something horribly, but any help would be so greatly appreciated.

*disclaimer: Sorry about the long text and also I have only been at my post for a year, and only in any capacity since the beginning of this semester. The previous sys-admin who did everything here left this sem. So basically I didn't set up these servers and the apache install etc.

Edit1:Testing on Windows 7 with Firefox 15, Chrome 22, and IE 9 all give the same result

Edit2: Relevant vhosts.d 00_ssl_domain.name.edu.conf

<IfDefine SSL>
#<IfDefine SSL_DEFAULT_VHOST>
<IfModule ssl_module>
# see bug #178966 why this is in here

# When we also provide SSL we have to listen to the HTTPS port
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
# Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
Listen 128.220.29.244:443

#Added so that the ServerName directive works
NameVirtualHost 128.220.29.244:443
# Go ahead and accept connections for these vhosts
# from non-SNI clients
SSLStrictSNIVHostCheck off
<VirtualHost 128.220.29.244:443>
        ServerName domain.name.edu
        #Include /etc/apache2/vhosts.d/default_vhost.include
        Include /etc/apache2/vhosts.d/domain.include

        <IfModule log_config_module>
                TransferLog /var/log/apache2/ssl_access_domain.name.edu
        </IfModule>

        ## SSL Engine Switch:
        # Enable/Disable SSL for this virtual host.
        SSLEngine on
        #SSLLog /var/log/apache2/ssl_engine_log
        LogLevel debug

        ## SSL Cipher Suite:
        # List the ciphers that the client is permitted to negotiate.
        # See the mod_ssl documentation for a complete list.
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

        ## Server Certificate:
        # Point SSLCertificateFile at a PEM encoded certificate. If the certificate
        # is encrypted, then you will be prompted for a pass phrase. Note that a
        # kill -HUP will prompt again. Keep in mind that if you have both an RSA
        # and a DSA certificate you can configure both in parallel (to also allow
        # the use of DSA ciphers, etc.)
        SSLCertificateFile /etc/ssl/apache2/domain.name.edu.crt

        ## Server Private Key:
        # If the key is not combined with the certificate, use this directive to
        # point at the key file. Keep in mind that if you've both a RSA and a DSA
        # private key you can configure both in parallel (to also allow the use of
        # DSA ciphers, etc.)
        SSLCertificateKeyFile /etc/ssl/apache2/domain.name.edu.key

        ## Server Certificate Chain:
        # Point SSLCertificateChainFile at a file containing the concatenation of
        # PEM encoded CA certificates which form the certificate chain for the
        # server certificate. Alternatively the referenced file can be the same as
        # SSLCertificateFile when the CA certificates are directly appended to the
        # server certificate for convinience.
        SSLCertificateChainFile /etc/ssl/apache2/geotrust.crt
        #SSLCertificateChainFile /etc/ssl/test-certs/geotrust.crt

        ## Certificate Authority (CA):
        # Set the CA certificate verification path where to find CA certificates
        # for client authentication or alternatively one huge file containing all
        # of them (file must be PEM encoded).
        # Note: Inside SSLCACertificatePath you need hash symlinks to point to the
        # certificate files. Use the provided Makefile to update the hash symlinks
        # after changes.
        #SSLCACertificatePath /etc/ssl/apache2/ssl.crt
        #SSLCACertificateFile /etc/ssl/apache2/ca-bundle.crt

        ## Certificate Revocation Lists (CRL):
        # Set the CA revocation path where to find CA CRLs for client authentication
        # or alternatively one huge file containing all of them (file must be PEM
        # encoded).
        # Note: Inside SSLCARevocationPath you need hash symlinks to point to the
        # certificate files. Use the provided Makefile to update the hash symlinks
        # after changes.
        #SSLCARevocationPath /etc/ssl/apache2/ssl.crl
        #SSLCARevocationFile /etc/ssl/apache2/ca-bundle.crl

        ## Client Authentication (Type):
        # Client certificate verification type and depth. Types are none, optional,
        # require and optional_no_ca. Depth is a number which specifies how deeply
        # to verify the certificate issuer chain before deciding the certificate is
        # not valid.
        #SSLVerifyClient require
        #SSLVerifyDepth  10

        ## Access Control:
        # With SSLRequire you can do per-directory access control based on arbitrary
        # complex boolean expressions containing server variable checks and other
        # lookup directives. The syntax is a mixture between C and Perl. See the
        # mod_ssl documentation for more details.
        #<Location />
        #       #SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
        #       and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
        #       and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
        #       and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
        #       and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
        #       or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
        #</Location>

        ## SSL Engine Options:
        # Set various options for the SSL engine.

        ## FakeBasicAuth:
        # Translate the client X.509 into a Basic Authorisation. This means that the
        # standard Auth/DBMAuth methods can be used for access control. The user
        # name is the `one line' version of the client's X.509 certificate.
        # Note that no password is obtained from the user. Every entry in the user
        # file needs this password: `xxj31ZMTZzkVA'.

        ## ExportCertData:
        # This exports two additional environment variables: SSL_CLIENT_CERT and
        # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the server
        # (always existing) and the client (only existing when client
        # authentication is used). This can be used to import the certificates into
        # CGI scripts.

        ## StdEnvVars:
        # This exports the standard SSL/TLS related `SSL_*' environment variables.
        # Per default this exportation is switched off for performance reasons,
        # because the extraction step is an expensive operation and is usually
        # useless for serving static content. So one usually enables the exportation
        # for CGI and SSI requests only.

        ## StrictRequire:
        # This denies access when "SSLRequireSSL" or "SSLRequire" applied even under
        # a "Satisfy any" situation, i.e. when it applies access is denied and no
        # other module can change it.

        ## OptRenegotiate:
        # This enables optimized SSL connection renegotiation handling when SSL
        # directives are used in per-directory context.
        #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>

        <Directory "/var/www/localhost/cgi-bin">
                SSLOptions +StdEnvVars
        </Directory>

        ## SSL Protocol Adjustments:
        # The safe and default but still SSL/TLS standard compliant shutdown
        # approach is that mod_ssl sends the close notify alert but doesn't wait
        # for the close notify alert from client. When you need a different
        # shutdown approach you can use one of the following variables:

        ## ssl-unclean-shutdown:
        # This forces an unclean shutdown when the connection is closed, i.e. no
        # SSL close notify alert is send or allowed to received.  This violates the
        # SSL/TLS standard but is needed for some brain-dead browsers. Use this when
        # you receive I/O errors because of the standard approach where mod_ssl
        # sends the close notify alert.

        ## ssl-accurate-shutdown:
        # This forces an accurate shutdown when the connection is closed, i.e. a
        # SSL close notify alert is send and mod_ssl waits for the close notify
        # alert of the client. This is 100% SSL/TLS standard compliant, but in
        # practice often causes hanging connections with brain-dead browsers. Use
        # this only for browsers where you know that their SSL implementation works
        # correctly.
        # Notice: Most problems of broken clients are also related to the HTTP
        # keep-alive facility, so you usually additionally want to disable
        # keep-alive for those clients, too. Use variable "nokeepalive" for this.
        # Similarly, one has to force some clients to use HTTP/1.0 to workaround
                SSLOptions +StdEnvVars
        </Directory>

        ## SSL Protocol Adjustments:
        # The safe and default but still SSL/TLS standard compliant shutdown
        # approach is that mod_ssl sends the close notify alert but doesn't wait
        # for the close notify alert from client. When you need a different
        # shutdown approach you can use one of the following variables:

        ## ssl-unclean-shutdown:
        # This forces an unclean shutdown when the connection is closed, i.e. no
        # SSL close notify alert is send or allowed to received.  This violates the
        # SSL/TLS standard but is needed for some brain-dead browsers. Use this when
        # you receive I/O errors because of the standard approach where mod_ssl
        # sends the close notify alert.

        ## ssl-accurate-shutdown:
        # This forces an accurate shutdown when the connection is closed, i.e. a
        # SSL close notify alert is send and mod_ssl waits for the close notify
        # alert of the client. This is 100% SSL/TLS standard compliant, but in
        # practice often causes hanging connections with brain-dead browsers. Use
        # this only for browsers where you know that their SSL implementation works
        # correctly.
        # Notice: Most problems of broken clients are also related to the HTTP
        # keep-alive facility, so you usually additionally want to disable
        # keep-alive for those clients, too. Use variable "nokeepalive" for this.
        # Similarly, one has to force some clients to use HTTP/1.0 to workaround
        # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
        # "force-response-1.0" for this.
        <IfModule setenvif_module>
                BrowserMatch ".*MSIE.*" \
                        nokeepalive ssl-unclean-shutdown \
                        downgrade-1.0 force-response-1.0
        </IfModule>

        ## Per-Server Logging:
        # The home of a custom SSL log file. Use this when you want a compact
        # non-error SSL logfile on a virtual host basis.
        <IfModule log_config_module>
                CustomLog /var/log/apache2/ssl_request_log \
                        "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
        </IfModule>
</VirtualHost>
</IfModule>
#</IfDefine>
</IfDefine>

# vim: ts=4 filetype=apache

Edit 3: Output of apache2 -S

[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
[Thu Oct 25 11:02:02 2012] [warn] _default_ VirtualHost overlap on port 80, the first has precedence
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80                   domain1.edu (/etc/apache2/vhosts.d/10_domain1.edu.conf:38)
*:80                   domain2.edu (/etc/apache2/vhosts.d/10_domain2.edu.conf:38)
*:80                   domain3.edu (/etc/apache2/vhosts.d/10_domain3.edu.conf:38)
*:80                   domain4.edu (/etc/apache2/vhosts.d/10_domain4.edu.conf:38)
*:80                   domain5.edu (/etc/apache2/vhosts.d/10_domain5.edu.conf:38)
*:80                   domain6.edu (/etc/apache2/vhosts.d/10_domain6.edu.conf:38)
*:80                   domain7.edu (/etc/apache2/vhosts.d/10_domain7.edu.conf:38)
*:80                   domain8.edu (/etc/apache2/vhosts.d/10_domain8.edu.conf:38)
*:80                   domain9.edu (/etc/apache2/vhosts.d/10_domain9.edu.conf:38)
*:80                   domain10.edu (/etc/apache2/vhosts.d/10_domain10.edu.conf:38)
*:80                   domain11.edu (/etc/apache2/vhosts.d/10_domain11.edu.conf:38)
Syntax OK

I don't have any problem accessing any sites, just the SSL errors

share|improve this question
    
How are you testing the web site? For example, if you are testing with IE on XP, SNI definitely won't work. –  David Schwartz Oct 23 '12 at 19:16
2  
There's a typo in the path to the chain file. Is that in the config or just in your question? –  Ladadadada Oct 23 '12 at 23:00
    
Sorry about the lethargic reply, guess the email alerts didn't work as expected. @Ladadadada Unfortunately it is just a typo in my question. Wouldn't that have been a funny turn of events. –  tmband25 Oct 24 '12 at 14:55
    
@David Schwartz I'm testing on Windows 7 with IE 9, Chrome 22.0.1.1229.94, and Firefox 15.0.1. All return the cert error –  tmband25 Oct 24 '12 at 14:57
    
Include the contents of the relevant vhost file, and the output of apachectl -S. –  adaptr Oct 24 '12 at 15:04
show 5 more comments

1 Answer 1

You do not have any SSL vhosts configured; verify that the ssl config file is in fact included in the main config.

You also need to define a NameVirtualHost *:80 outside of any vhosts, or all requests will go to the first one, as the output tells you.

share|improve this answer
    
In the vhosts.d folder everything has .conf at the end including the ssl configs and consequently should be included. I added NameVirtualHost *:80 to httpd.conf and while there are no more warnings from /usr/sbin/apache2 -S it has not fixed the SSL problem –  tmband25 Nov 1 '12 at 17:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.