1

I followed this tutorial (though it's for 5.2, I figured I'd be alright).

The changes I had to make that seemed to have worked:

  • Rename ca.csr to ca.cslr (that's the one the command generated)
  • List it in the ssl.conf as ca.cslr instead of ca.csr

I have the following in the httpd.conf

<VirtualHost *:80>
DocumentRoot /etc/test
ServerName site.com
</VirtualHost>
<VirtualHost *:433>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
<Directory /etc/test>
AllowOverride All
</Directory>
DocumentRoot /etc/test
ServerName cryptokings.com
</VirtualHost>

/test contains a folder inside of it, accessible via http://site.com/test/foo, however attempting to access it via https://site.com/test/foo results in

  • warning that the certificate is untrusted (self-signed, no biggie)
  • a 404 error.

Chrome's complains about the certificate are the following:

The identity of this website has not been verified.
 • Server's certificate does not match the URL.
 • Server's certificate is not trusted.

I think those warnings are a side-effect of a self-signed certificate - or is the first one something that needs to be addressed?

I seem to be able fetch the root page via https just fine though, it shows a standard CentOS setup page. (That said, I haven't added a VirtualHost entry for it so I suppose that makes sense)

I think I've made a mistake somewhere during the setup as I'm not too familiar with the process.

During setup, I was prompted for a type of password that would be required when apache restarts but running service httpd restart does not seem to prompt me for one.

Any help would be appreciated.

2
  • What's in apache's error log? Jun 25, 2013 at 23:37
  • It doesn't say anything. When I go to root it says: [Tue Jun 25 16:47:14 2013] [error] [client xx.me.xx.xxx] File does not exist: /etc/test/favicon.ico
    – dsp_099
    Jun 25, 2013 at 23:52

1 Answer 1

0

Browsers will look for favcion.ico (the favourites icon for the site) as a matter of course. They will use it if available for bookmarks and tab or toolbar icons, usually, but will have a fallback plan; unless you intended to specify an icon, you don't need to worry about this error and can ignore it completely.

As for the SSL issue, that the server's certificate does not match the URL, you should solve this; if you don't, there will be no operational consequences; however, trusting your certificate (by adding it to the trust root store on the client) will not entirely suppress SSL validation warnings in this case. You should ensure that the domain name of your website (likely cryptokings.com) appears in the SSL certificate either as the subject name (CN) or a subject alternative name (SAN). You should cover all supported subdomains in the certificate, so if www.cryptokings.com resolves to the same virtualhost, your certificate should cover them both (either explicitly, or as a wildcard certificate).

The behaviour being different in your two browsers is most likely due only to the fact that one of them simply reports the first reason the certificate couldn't be verified, instead of an exhaustive list of reasons, where more than one reason exists.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .