1

I've installed multiple SSL's on our server and we've never add any problems. But for the first time I have to create a wildcard SSL and when I add it to the virtual hosts, apache crashes ( php doesn't work ) but there is no errors logs...

Here's a typical SSL I would do in the virtual host.

<VirtualHost XXX.XX.XXX.109:443>
        ServerName www.test.ca
        ServerAlias test.ca

        DocumentRoot /home/blahblah/blahb;ah

        SSLEngine on

        SSLCertificateFile /etc/apache2/ssl/test.ca/test.ca.crt
        SSLCertificateKeyFile /etc/apache2/ssl/test.ca/test.ca.key
</VirtualHost>

That works,

Now for my wildcard SSL I did :

<VirtualHost XXX.XX.XXX.110:443>
        ServerName test2.ca
        ServerAlias *.test2.ca

        DocumentRoot /home/blah/blah/

 #       SSLEngine on

 #       SSLCertificateFile /etc/apache2/ssl/test2.ca/test2.ca.crt
 #       SSLCertificateKeyFile /etc/apache2/ssl/test2.ca/test2.ca.key

</VirtualHost>

// I commented those 3 lines because if I don't it crashes.

To create my key I did " openssl genrsa -out {domainname}.key 1024 " and to create my crt i went on trustico and filled in all my information and it generated it for me

Any ideas?

Thanks

9
  • Anything show up in your error logs?
    – larsks
    Nov 19, 2010 at 16:20
  • Wildcards and SSL is poorly supported. The Apache folks seem to think you should never combine the two so I've stumbled on some odd behavior in that area. What kind of crash are you seeing? A hard server crash or just a config file failure?
    – mfarver
    Nov 19, 2010 at 16:21
  • I've never seen Apache act quite that way... Does adding the CA's chain file with SSLCertificateChainFile /etc/path/to/file make any difference?
    – Chris S
    Nov 19, 2010 at 16:23
  • @ larsks, there is no logs, none in the access.log and in the error.log Nov 19, 2010 at 16:23
  • @mfarver Apache Crashes, so when I go to like "test.ca" it brings me to google as if that site doesnt exists. We have over 300 url's on our server and once I enable the SSL they all crash Nov 19, 2010 at 16:25

2 Answers 2

1

So it appears like there was a problem with my initial private key file. I re-created my .key my .csr and my .crt enabled it and then all sites were still working.

To make the certificate work though I did need the SSLCertificateChainFile.

Thanks everyone

0

Are you using SubjectAltName attribute in your SSL Certs?

If so, then I don't see

UseCanonicalName On

in your virtual host directive. I assume you have a separate virtual host directive for each ServerName directive within too.

5
  • Trustico made the CRT for me, with the information I provided so I am not sure if the SubjectAltName is used. Should I try UseCanonicalName On? And yes each different IP has a different virtual host. Nov 19, 2010 at 17:26
  • "each different IP" If you have a separate IP for each FQDN, then why are you using wild card certs? (cost savings or something?) Yes, I believe you need the UseCanonicalName On directive.
    – Kilo
    Nov 19, 2010 at 17:42
  • Well, we host many clients. So test1.com will have a normal SSL ( no wildcard ) and test2.com could have a wildcard SSL. Nov 19, 2010 at 18:10
  • just tried adding UseCanonicalName On and it still crashed all sites on the server Nov 19, 2010 at 18:14
  • Do you know if your certs need intermediate certs? The example given shows no intermediate certs and many 'new comers' to the SSL cert offering market tend to require this. Trustico mentions GeoTrust and Verisign so it would appear they are an intermediary. Post a https URL that is protected by one of their certs and I'll examine it for you (if you have one).
    – Kilo
    Nov 19, 2010 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .