My company purchased a wildcard certificate from a vendor. This certificate was successfully configured with Apache 2.2 to secure a subdomain. Everything on the SSL side works.

Now I'm required to generate x509 client-side certificates to issue for this subdomain. I'm following along this page: (http://www.vanemery.com/Linux/Apache/apache-SSL.html), starting with "Creating Client Certificates for Authentication".

I've generated the p12 files and successfully imported them into Firefox. When I browse to the site now, I get an error in FireFox that says "The connection to the server was reset while the page was loading."

I think my problem is coming from not signing the client-side correctly. When I sign the client-side certificate, I'm using the PEM file (RapidSSL_CA_bundle.pem) from RapidSSL (who we bought the certificate from) for the -CA argument. For the -CAkey argument, I'm using the private key of the server. Is this correct?

  • I think ServerFault would be a more appropriate place for a question since it's clearly a configuration issue and not a programming one. Mar 4 '11 at 16:40
  • My bad. Didn't realize this was misplaced.
    – walshms
    Mar 4 '11 at 16:54
  • No, that is not correct. Mar 5 '11 at 13:21

I do not think that the license for a wildcard certificate allows you to use it for signing other certificates. You need to be a certificate authority to be able to do that.

  • Thanks. I think after trying to talk with my CA's technical support I got to this conclusion.
    – walshms
    Mar 7 '11 at 20:33

Apache is probably resetting the connection. Try looking at your log files. If you are on *nix system this should be in /var/log/apache/error.log.


Use openssl to view the contents of your generated certificate. It will then be obvious if your signing is working correctly.

openssl x509 -text -noout -in <yoursignedcert>

If that looks OK and appears to have an Issuer field that reflects where it is signed try using openssl to attach to your server and see what it is expecting.

openssl s_client -connect <host>:port -CAfile <yourtrustcert> -cert <yoursignedcert>

That should give some clues as to whether the server is requesting your certificate or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.