I recently purchased and set up a VPS, and one of the first steps I took was to purchase and install an SSL Certificate. I had issues getting everything set up, but after quite a bit of research and head pounding it was finally set up correctly. I had a rewrite in the .htaccess file that forced https connections. Everything was sunshine and lolly-pops. Then came heartbleed!
I had my SSL certificate reissued, and created new private keys. I then followed these steps to create a chained file. Now, when I try to start apache2, I'm getting the following error:
[Mon Apr 28 10:32:59 2014] [warn] RSA server certificate CommonName (CN) `example.com' does NOT match server name!?
[Mon Apr 28 10:32:59 2014] [error] Unable to configure RSA server private key
[Mon Apr 28 10:32:59 2014] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
What exactly does that mean? The certificate was just reissued, so there shouldn't have been any changes to the server name. Did I flub making the chain file?
Other Information
Ubuntu 12.04 LTS, with Apache 2.2.22. Oddness: I updated OpenSSL, and had no issues, prior to reissuing the cert. Now openssl version
returns "OpenSSL 1.0.1 14 Mar 2012". Furthermore, I went to this checker and this checker after setting everything back up, and got a clean bill of health for both. However, I don't think I ever restarted apache after changing the certificates.
Thoughts, advice, and guidance are appreciated!
Update
In my default-ssl
I have it pointing to the following:
SSLCertificateFile /etc/apache2/ssl/developingawesomeness.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/developingawesomeness.com.key
SSLCertificateChainFile /etc/apache2/ssl/developingawesomeness.com.chain.pem
Those files are in those directories as well.
I had my SSL certificate reissued, and created new private keys.
In that order? That sounds like you crated a CSR with the old key and then switched the private key to a new one.openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr
to generate a new csr, and used that to get the new cert.openssl x509 -in server.crt -noout -text
.