We recently switched our SSL certificates on our web hosting environment and the old certificates are still showing up on certain computers with IE installed. It works perfectly fine in both Firefox and Chrome.

On the computers that are having errors, IE is looking at the old SSL cert at *.website1.org instead of the new SSL cert at *.website2.org, thus causing security errors. We've cleared the SSL state in the internet options, removed all cookies/temp files/history/etc.., made sure the time on the computer is correct, and done just about everything we can think of to try and get these computers to view the new certificate.

That all being said, SSL Checker is looking at the old certificate as well, so that's not good obviously.



I'd wager that it's not caching, it's Server Name Indication.

Systems supporting SNI are getting the cert from the VirtualHost, while systems that do not (likely including that SSL Checker) are getting the first certificate to load on that port - which is not this one.

Scour your config for something else loading the old certificate (it's loading before the VirtualHost that you have there). Oh, and do a full restart on the apache process (not a reload) after changing it.

  • I think you're right on track here as we are proxying all of our sites through one port on apache, but several different ports on the application server, which is the backend. I have added the full config file above.
    – FAtBalloon
    Nov 11 '11 at 19:50
  • 1
    @FAtBalloon Nothing else there - it'll likely be outside of this file, in either a different site file, in the main config, or in an ssl-specific config file. Running grep against the entire Apache config tree for SSLCertificateFile may be the best approach if you aren't sure where to look. Nov 11 '11 at 19:57
  • So we definitely have it in other files, as there are multiple sites using multiple SSL certs on this box. That all being said, is there a way to fix this without setting up new boxes with new IPs? ....Lots of lovely legacy stuff we're dealing with here. Love it.
    – FAtBalloon
    Nov 11 '11 at 20:00
  • 2
    @FAtBalloon Unfortunately, no; those clients that don't support SNI will always get the first certificate that loads on the port. Hopefully in a year or three, there will be few enough clients that it'll be practical to depend on SNI for internet-facing sites. Your best bet would be to obtain an additional IP address to bind to with the second certificate. Nov 11 '11 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.