Catchall SSL needs to be applied on Amazon server with elastic IP

Question

I have 2 web applications hosted on an EC2 Amazon server that uses an elastic IP. I have a catchall * SSL certificate that I am trying to apply to both web applications.

I have generated the CSR file by following GoDaddy's instructions

I have SSL enabled on apache and I have installed the SSL on the server (linking to the correct path in the Vhosts).

When I test the https urls I get the following error:

web-application uses an invalid security certificate.

The certificate is not trusted because it is self-signed. The certificate is only valid for ip-10-236-91-228

The IP listed is the internal private IP of the Amazon server, and not the public facing IP.

Has anyone else had similar problems, or know how to fix this?

Thanks,

Tom

Answer 1

It looks like you created an SSL certificate for the private IP hostname of the EC2 instance instead of for your own wildcard domain where you plan to send users in their web browsers.

You're probably going to have to purchase a new certificate. Don't follow GoDaddy's instructions quite so closely this time, especially when it asks you to enter the host/domain for the certificate.

Here's where I've purchased my wildcard SSL certificates lately (much cheaper): http://www.namecheap.com/ssl-certificates/comodo.aspx

Answer 2

Have you installed the intermediate certificate?

Most SSL certificates require that you install an intermediate certificate on the server as well as your actual domain certificate

The error you have reported will appear if this intermediate certificate is missing.

Your email from GoDaddy should have included both your domain certificate and the intermediate one, if not you can download the intermediate from their website https://certs.godaddy.com/anonymous/repository.seam

This certificate needs to be saved somewhere on your instance (in addition to your domain certificate) add the line...

SSLCertificateChainFile /path/to/your/intermediate/file

...to your apache virtual host config file (obviously replacing /path/to/your/intermediate/file with the actual path on your server)

You'll then need to restart apache.