Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to setup apache2.2 with ssl, but I am having trouble to connect remotely to it.

My Virtualhost looks like this:
NameVirtualHost *:443
 <VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/host1/apache.pem

    ServerName mail.host1.net

    DocumentRoot /usr/share/squirrelmail
    <Directory />
            Options -Indexes
            AllowOverride All
    </Directory>

    ErrorLog /var/log/apache2/mail.host1.log
    LogLevel warn

    CustomLog /var/log/apache2/mail.host1-access.log combined

    ServerSignature Off
</VirtualHost>

I've created the ssl file using this tutorial: http://wiki.debian.org/Self-Signed_Certificate

When I connect local

server ~ openssl s_client -connect localhost:443
CONNECTED(00000003)
depth=0 /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
verify return:1
---
Certificate chain
 0 s:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
i:/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
issuer=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd
---
No client certificate CA names sent
---
SSL handshake has read 1265 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: [...]
    Session-ID-ctx: 
    Master-Key: [...]
    Key-Arg   : None
    Start Time: 1357993878
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
closed

but when I do it remotely:

[13:27:05:gentoo@~/]openssl s_client -connect mail.host1.net:443
CONNECTED(00000003)
139720085706408:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 322 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Nmap tells me that port 443 is open.

When I connect to my site via http://mail.host1.net:443 it works, but ssl doesn't

Hope someone can help.

The log says nothing but:

[Sat Jan 12 19:25:50 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sat Jan 12 19:25:50 2013] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

You also need SSLCertificateKeyFile pointing to the private key. But that doesn't explain why you'd get a working SSL connection to localhost - sounds like you might have bits of an older config still in place.

Did you fully restart Apache after making the SSL config changes? Can you provide the output of apachectl -S?

share|improve this answer
    
You are almost right: SSLCertificateKeyFile is not required. Anyway. I had some misconfiguration in my apache configs. Apache directed my request to the wrong VirtualHost and so no SSL connection was possible. Thanks! –  isset Jan 12 '13 at 20:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.