Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am replacing our SSL cert on our Apache web server.

This is the first time I have done this, with my 2 colleagues being on holiday, and an urgent need to replace our SSL cert(due to the openssl bug), Would someone mind giving me some pointers.

I have read up but just want to double check the following procedure is correct

I have generated a new private key, and CSR. Have sent the CSR to the CA, they have now issued me with a new crt and ca-bundle file.

Do I simply replace the private key,the new crt and the new ca-bundle and restart httpd?

Are there any other tasks that need to be carried out before doing this?

share|improve this question
    
Besides the obvious, but often overlooked, back-up before you start, no. That should be it. You might want to verify the new certificate matches the hostnames (Subject and possibly additional X509v3 SubjectAltName names) of the old one with openssl x509 -text -in cert.pem –  HBruijn Apr 9 at 12:14

1 Answer 1

up vote 1 down vote accepted

You've already done the hard work. And you're correct in that you need to replace BOTH the private key as well as the certs that have been re-issued to you.

All you need to do now is replace the old key files with the new crt and ca-bundle.

And yes, you DO have to restart Apache (httpd). If you're unsure of having it take or not, consider rebooting the entire machine too.

Of course, all of this is a moot point if you didn't patch your system first. So, steps in the proper order would be:

  • Patch your System (install fixed version of OpenSSL)
  • Restart Apache
  • Generate new Private Key
  • Obtain the new CRT from the CA
  • Replace your certificates
  • Restart Apache (or better yet, restart your whole server)
share|improve this answer
    
Thanks for the advice... So I copies the files as above, restarted httpd but got an error:SSL Library Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch. This would suggest to me that the private key does not match the certs sent over by CA. I am 100% sure that the i'm using the private key that openssl spat out when generating the csr. Any ideas?? –  Nathan Foley Apr 9 at 13:06
    
I have just put the old keys back in pace and now is all fine. I have just seen HBrujin's comment... I will perform the check suggested now –  Nathan Foley Apr 9 at 13:12
    
Ok so checked the cert I received, the X509v3 Subject Alternative Name are correct, I cant see a hostname section in there though, but this matches the origional, I can see the hostname in the "subject" though... CN={hostname} –  Nathan Foley Apr 9 at 13:31
    
OK, so ran openssl x509 -noout -modulus -in server.crt | openssl md5 and openssl rsa -noout -modulus -in myserver.key | openssl md5 .... The Modulus do not match :( . I'm not sure what happened here. I do not have any other private keys/csr's on the server except the ones that are currently used in production scratches head Has anyone had any similar issues when changing ssl certs? I am thinking maybe I entered some of the OU details, that openssl prompts for, incorrectly? But surely the private and public should still match? I have requested new cert. Thanks again for your comments –  Nathan Foley Apr 9 at 14:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.