Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get an SVN server up and running. CentOS 6.4, apache 2.2.15. More importantly, I need to have it running on https only. So I figure that I'll get ssl running first, as I've already tested it on port 80, and SVN works the way I want it to. So this is probably more apache-related than SVN.

In /etc/httpd/ssl, I have ..


We bought a wildcard certificate from GeoTrust, and I downloaded the intermediate.crt from their website. In /etc/httpd/httpd.conf, I have..

NameVirtualHost *:80

<VirtualHost *:80>
        ErrorLog logs/error_log
        CustomLog logs/access_log common
        Redirect permanent /

        SSLEngine On
        SSLCertificateFile /etc/httpd/ssl/
        SSLCertificateKeyFile /etc/httpd/ssl/
        SSLCertificateChainFile /etc/httpd/ssl/intermediate.crt
        ErrorLog logs/subversion-error_log
        CustomLog logs/subversion-access_log common

I can connect to the server, but my browser tells me that the certificate is untrusted. So I'm guessing that there's an error in the permissions, or perhaps in the format of the file?

I can't see anything in the logs.

I set this up at home on my own server, but wasn't using a wildcard certificate.

Anyone care to advise as to what's gone wrong?


share|improve this question
Please consider either telling us the domain name, or posting the certificate and intermediate (but not the keyfile!) here. It's hard to say what might be the issue with a certificate noone can see, and there are no security implications to making a certificate public - that's what it's for. – MadHatter Nov 1 '13 at 12:09
Were you connecting to the server using a name that's covered by the wildcard certificate? – David Schwartz Nov 1 '13 at 12:54
maybe you download wrong GeoTrust intermediate.crt? They have 2 different bundles for certificates issued before and after June 13, 2013 – user1516873 Nov 1 '13 at 12:56
If you run "openssl s_client -connect" from a Linux or Cygwin prompt, if should give you a bit more to go on.. – Chainik Nov 1 '13 at 15:29

The above setup missed the Certificate Authority (CA) file, somt:

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
share|improve this answer
That option doesn't do what you think it does. Check it: Your instructions would have the server trust all client certificates issued by the trusted public CAs, which is generally a bad idea, and has nothing to do with the server certificate. – Falcon Momot Nov 12 '14 at 9:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.