I am trying to set up ssl support for Apache 2 on Debian. Versions are:

Debian GNU/Linux 6.0
apache2 2.2.16-6+squeeze1

I followed a lot of how-tos for days but I couldn't make it work. Here are my steps and configuration files (ServerName and DocumentRoot are changed for privacy, in case tell me):

# mkdir /etc/apache2/ssl
# openssl req $@ -new -x509 -days 365 -nodes -out /etc/apache2/ssl/apache.pem -keyout /etc/apache2/ssl/apache.pem

at this point I've a doubt about permissions on apache.pem, at this step they are

-rw-r--r-- 1 root root

Maybe it has to belong to www-data? Then I enable ssl-mod with

# a2enmod ssl
# /etc/init.d/apache2 restart

I modify /etc/apache2/sites-available/default-ssl in this way (I put port 8080 because I need port 443 for another purpose):

<VirtualHost *:8080>
SSLEngine on
SSLCertificateFile    /etc/apache2/ssl/apache.pem
SSLCertificateKeyFile /etc/apache2/ssl/apache.pem

ServerAdmin webmaster@localhost

    DocumentRoot /var/www
    <Directory />
            Options Indexes FollowSymLinks
            AllowOverride All
    <Directory /var/www/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            allow from all

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
            Order allow,deny
            Allow from all

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
    Allow from ::1/128


<VirtualHost *:8080>
DocumentRoot /home/user1/public_html/
ServerName first.server.org

# Other directives here


<VirtualHost *:8080>

DocumentRoot /home/user2/public_html/
ServerName second.server.org

# Other directives here


I have to point out that the same configuration works on http (it is a copy of /etc/apache2/sites-available/default with some differences -> port and ssl support). My /etc/apache2/ports.conf is the following:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

#NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
# If you add NameVirtualHost *:443 here, you will also have to change
# the VirtualHost statement in /etc/apache2/sites-available/default-ssl
# to <VirtualHost *:443>
# Server Name Indication for SSL named virtual hosts is currently not
# supported by MSIE on Windows XP.
#NameVirtualHost *:8080
Listen 8080

<IfModule mod_gnutls.c>
Listen 8080

Any suggestion?

  • Looks fine at a glance. What error message do you get when you try to run with this config? – James T Snell Jun 24 '11 at 19:44
  • with /etc/init.d/apache2 force-reload I got Reloading web server config: apache2[Fri Jun 24 19:50:34 2011] and 5 times [warn] _default_ VirtualHost overlap on port 8080, the first has precedence if I try to go to my.server.org I get this error: SSL connection error Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have. Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error. – gc5 Jun 24 '11 at 20:15
  • The default https port is 443. If you want to use 8080 then your client will need to go to https://my.server.org:8080/ – DerfK Jun 24 '11 at 22:45
  • @DerfK Thanks to your suggestion, I found out that using :8080 in the url does the work. But at the moment I could not use port 443 because I have another service (openvpn) working at that port.. Is there a way to redirect https to another port different from 443? – gc5 Jun 25 '11 at 1:37
  • There is no way to have OpenVPN tell webbrowsers that connect to it to connect to a different port. – DerfK Jun 25 '11 at 1:50

According to your config you have several virtual hosts on the same port that you want to use ssl on - and apparently only one of them is configured for ssl.

  1. A port is either ssl enabled or not, you can't have both on the same port.
  2. You can't have several virtual hosts on a port that you're using ssl on.

Remove all other virtual host definitions or change their port or ip address and test it again.

  • 1
    You CAN have several virtual hosts on a port that you're using SSL on, you just need to have a certificate which lists alternate common names for the other virtual hosts or a wildcard certificate. Or, build apache+mod_ssl against an openssl that supports SNI along with using clients that support SNI in order to allow apache to select the right certificate. But in this case, "1." is the problem. He needs to change the second <VirtualHost *:8080> to <VirtualHost *:80> – DerfK Jun 24 '11 at 22:54
  • yes, several CNs or wildcard would work, hadn't thought of that. – sborsky Jun 25 '11 at 9:00
  • About SNI: Can you rely on this being supported by most clients nowadays? Haven't checked recently. – sborsky Jun 25 '11 at 9:10
  • 1
    Nope. No IE on any XP SP will do it. – DerfK Jun 25 '11 at 11:01

You have a probable misconfiguration at this spot:

SSLCertificateFile    /etc/apache2/ssl/apache.pem
SSLCertificateKeyFile /etc/apache2/ssl/apache.pem

Your cert file and key should be separate files.

I don't know how to do it your way. But to get your stuff working, you also might need to follow my guide for using Java Keytool to create a keystore and then export the key out of the keystore for use with Apache. With that method, i know it works.

After following my guide you will have:

SSLCertificateFile    /etc/apache2/ssl/exported-pem.crt  
    SSLCertificateKeyFile /etc/apache2/ssl/exported-pem.key

I'm not sure, but I read through your steps and I noticed the following:

  1. you skipped the CSR step and then also skipped signing the cert request
  2. you didn't strip the password from the private key (but that is only necessary on Windows platform; that being the case, Apache needs to know the password to read the key and I am not seeing where you did that)
  3. as far as the ssl config goes, im my experience the default ssl configuration file should work as long as you enable its directive in your http.conf file.
  • I think djangofan's correct here.. My Apache server's all have two different ssl certificate files, three in some cases, that must be referenced in the config.. The third applies when it's a for-real ssl cert, not a self-signed one.. – James T Snell Jun 24 '11 at 22:02
  • Apache supports having both the cert and the key together in the same file, but in this case, only SSLCertificateFile should be used: httpd.apache.org/docs/2.2/mod/… – DerfK Jun 24 '11 at 22:46
  • Yeah, but if you do it that way then you need to take responsibility for the additional difficulty caused by it. I wouldn't recommend doing it that way, although it would work. Having the files separate makes things clearer, especially to a beginner. – djangofan Jun 28 '11 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.