Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to get an SVN server up and running. CentOS 6.4, apache 2.2.15. More importantly, I need to have it running on https only. So I figure that I'll get ssl running first, as I've already tested it on port 80, and SVN works the way I want it to. So this is probably more apache-related than SVN.

In /etc/httpd/ssl, I have ..

intermediate.crt wildcard.mycompany.com.crt wildcard.mycompany.com.key

We bought a wildcard certificate from GeoTrust, and I downloaded the intermediate.crt from their website. In /etc/httpd/httpd.conf, I have..

NameVirtualHost *:80

<VirtualHost *:80>
        ServerAdmin my.email@mycompany.com
        ServerName hostname.mycompany.com
        ErrorLog logs/error_log
        CustomLog logs/access_log common
        Redirect permanent / https://hostname.mycompany.com
</VirtualHost>

<VirtualHost hostname.mycompany.com:443>
        SSLEngine On
        SSLCertificateFile /etc/httpd/ssl/wildcard.mycompany.com.crt
        SSLCertificateKeyFile /etc/httpd/ssl/wildcard.mycompany.com.key
        SSLCertificateChainFile /etc/httpd/ssl/intermediate.crt
        ServerName hostname.mycompany.com
        ServerAdmin my.email@mycompany.com
        ErrorLog logs/subversion-error_log
        CustomLog logs/subversion-access_log common
</VirtualHost>

I can connect to the server, but my browser tells me that the certificate is untrusted. So I'm guessing that there's an error in the permissions, or perhaps in the format of the file?

I can't see anything in the logs.

I set this up at home on my own server, but wasn't using a wildcard certificate.

Anyone care to advise as to what's gone wrong?

Thanks.

share|improve this question
2  
Please consider either telling us the domain name, or posting the certificate and intermediate (but not the keyfile!) here. It's hard to say what might be the issue with a certificate noone can see, and there are no security implications to making a certificate public - that's what it's for. –  MadHatter Nov 1 '13 at 12:09
    
Were you connecting to the server using a name that's covered by the wildcard certificate? –  David Schwartz Nov 1 '13 at 12:54
    
maybe you download wrong GeoTrust intermediate.crt? They have 2 different bundles for certificates issued before and after June 13, 2013 –  user1516873 Nov 1 '13 at 12:56
1  
If you run "openssl s_client -connect mycompany.com:443" from a Linux or Cygwin prompt, if should give you a bit more to go on.. –  Chainik Nov 1 '13 at 15:29

1 Answer 1

The above setup missed the Certificate Authority (CA) file, somt:

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
share|improve this answer
    
That option doesn't do what you think it does. Check it: httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatefile Your instructions would have the server trust all client certificates issued by the trusted public CAs, which is generally a bad idea, and has nothing to do with the server certificate. –  Falcon Momot Nov 12 at 9:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.