Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup apache2.2 with ssl, but I am having trouble to connect remotely to it.

My Virtualhost looks like this:
NameVirtualHost *:443
 <VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/host1/apache.pem


    DocumentRoot /usr/share/squirrelmail
    <Directory />
            Options -Indexes
            AllowOverride All

    ErrorLog /var/log/apache2/mail.host1.log
    LogLevel warn

    CustomLog /var/log/apache2/mail.host1-access.log combined

    ServerSignature Off

I've created the ssl file using this tutorial:

When I connect local

server ~ openssl s_client -connect localhost:443
depth=0 /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
verify return:1
Certificate chain
 0 s:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
i:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
Server certificate
subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
No client certificate CA names sent
SSL handshake has read 1265 bytes and written 319 bytes
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: [...]
    Master-Key: [...]
    Key-Arg   : None
    Start Time: 1357993878
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)

but when I do it remotely:

[13:27:05:gentoo@~/]openssl s_client -connect
139720085706408:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 0 bytes and written 322 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE

Nmap tells me that port 443 is open.

When I connect to my site via it works, but ssl doesn't

Hope someone can help.

The log says nothing but:

[Sat Jan 12 19:25:50 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sat Jan 12 19:25:50 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
share|improve this question
up vote 1 down vote accepted

You also need SSLCertificateKeyFile pointing to the private key. But that doesn't explain why you'd get a working SSL connection to localhost - sounds like you might have bits of an older config still in place.

Did you fully restart Apache after making the SSL config changes? Can you provide the output of apachectl -S?

share|improve this answer
You are almost right: SSLCertificateKeyFile is not required. Anyway. I had some misconfiguration in my apache configs. Apache directed my request to the wrong VirtualHost and so no SSL connection was possible. Thanks! – isset Jan 12 '13 at 20:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.