I'm moving an SSL crt and key from one server to a new one. The old one was on a box with cpanel and the new one is just a LAMP Ubuntu box. I've been following tutorials and instructions for hours without getting anywhere. I've created a VirtualHost file listening on 443. All the non-https pages work, as soon as I go to an https page it gives me a connection denied. I tried using digicert.com/help which reports "No certificates found". How exactly do I go about troubleshooting this?

  • I have moved the key, crt, and cabundle over to the new box. I've CHMOD 600 and specified their locations in the VirtualHost file. The error I get when I'm trying to access any https page is connection refused. – jchysk Mar 9 '12 at 2:09

If you're getting a connection refused error, either the box isn't listening on port 443 or a firewall is blocking it. You can use netstat -an | grep :443 (on that box) to see if it's listening.

  • Guess I was being stupid. I still don't have it working, but I've gotten a little further and can continue debugging. Thanks. – jchysk Mar 9 '12 at 2:48

The VirtualHost that listens on 443 should have a block that looks something like this:

   SSLEngine on

   SSLCertificateFile /etc/pki/tls/certs/www.example.com.crt
   SSLCertificateKeyFile /etc/pki/tls/private/www.example.com-key
   SSLCertificateChainFile /etc/pki/tls/certs/startssl.intermediate.bundle.pem
   SSLCACertificateFile /etc/pki/tls/certs/startssl-ca.pem

You would copy the certificate and key files from your old server to the new, and adjust the paths in the configuration file as appropriate.

I have a couple lines in there that pertain to the Certificate Authority I'm using. Particularly, I'm specifying the intermediate certificates with the SSLCertificateChainFile line. You probably will need to do something similar with the files from your CA (look at the CA's docs for the specific files).

Once that's in place, reload apache. If there's a problem, check /var/log/httpd/error.log. Make sure the permissions are correct, i.e., the Apache user can read the above files, and that the private key isn't accessible by others.

  • Thanks for the very quick response. I have everything except the SSLCertificateChainFile. Is that required? The paths are correct, I know because it throws an error when I restart apache if it's not a valid file. The error log isn't giving anything. – jchysk Mar 9 '12 at 1:53
  • The chain file probably matters for getting the cert to validate in a browser, but shouldn't matter with just getting SSL turned on. Do you have the mod_ssl package installed? – cjc Mar 9 '12 at 2:00
  • Actually, if you have another Linux box, do a curl -Iv https://www.example.com. If there's an SSL response, it should show it. If there's a cert error, it will also show it. – cjc Mar 9 '12 at 2:01
  • What if I just get a connection refused error? Is there a way to show if the box is even listening on 443? I know it's listening on 80 because regular pages load, but netstat --listen doesn't show it. I believe I have mod_ssl installed, how can I verify? – jchysk Mar 9 '12 at 2:05
  • netstat -anlp |grep 443 will show if a process is listening on 443. If you run that as root, you'll also see what process. If you see that, and are getting a connection refused, then you probably have a firewall issue. You can see if mod_ssl is installed by running rpm -qi mod_ssl. – cjc Mar 9 '12 at 2:30

Just listening on 443 isn't enough. You'll need to tell apache what certificate to use. If you can retrieve the old one for your server, you just need to configure apache to use it.

This is well documented on apache.org.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.