2

I'm running an Ubuntu 10.04 LTS server that has been running Apache2 with a self signed certificate up until now. I finally purchased a real certificate but I can't manage to install it. I received three files from the provider:

AddTrustExternalCARoot.crt
mynewdomain_com.crt
PositiveSSLCA2.crt

Currently in my sites-enabled/ssl I have this for my self signed certificate:

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/cert.pem

So I googled how to convert crt files to pem and it just looks to be a concatination of all the crt files. This is the guide I found that mostly matched what I'm using (I am using namecheap for my DNS now). So I created my new pem file, and pointed my config at it. When I run

service apache2 restart

the daemon fails to start. I figured that I must have put the crts in the wrong order, but it still fails to start. What am I doing wrong? How can I use my new certificate?

As for Key files, I generated one called server.key (which was used to create my csr). It now resides in /etc/apache2/server.key

When starting apache I get these errors:

[Sat Mar 17 13:44:43 2012] [warn] RSA server certificate is a CA certificate  (BasicConstraints: CA == TRUE !?)
[Sat Mar 17 13:44:43 2012] [warn] RSA server certificate CommonName (CN) `PositiveSSL CA 2' does NOT match server name!?
[Sat Mar 17 13:44:43 2012] [error] Unable to configure RSA server private key
[Sat Mar 17 13:44:43 2012] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
2
  • What error do you receive from the service command and from /var/log/apache2/error_log?
    – Kyle Smith
    Mar 17, 2012 at 20:37
  • Most likely your crt files are DER, not PEM. Did you look at them? Do they look like PEM? Also, you may be confusing your certificate with the chain certificate. You really should look closely at the certificate files. You can use openssl x509 -text ... to dump the certificate. Mar 17, 2012 at 22:16

3 Answers 3

4

Can you provide information on how you generated the certificate?

You're missing the private key (probably a .key file) which was used to generate the .csr file that you sent to the certificate authority. That specific private key is required for Apache to be able to use the public key that you were given.

Edit:

With that key file, you'll need something like this added to your config:

SSLCertificateKeyFile /etc/apache2/server.key

Make sure that file is set to a permission mode where it's not viewable to everything on the server - mode 600 should be good.

If it won't start after that's added, let me know what errors come up (on the console or in the Apache error log).

With the .crt files that you got concatenated together, your Apache server should be sending full certificate chains properly; you can verify that it's working with openssl s_client -connect localhost:443 -showcerts.

6
  • Sure, I'll update my question Mar 17, 2012 at 20:27
  • so that key file goes into the pem? Mar 17, 2012 at 20:36
  • @CountMurphy Edited my answer. Mar 17, 2012 at 20:38
  • edited again :) Mar 17, 2012 at 20:46
  • @CountMurphy Your concatenation didn't work right. Start out with just pointing SSLCertificateFile at the mynewdomain_com.crt file. Mar 17, 2012 at 21:34
1

RSA server certificate is a CA certificate means thay you've specified you CA's cert as certificate file, not yours (which was signed by CA).

You may want to try to replace path to SSLCertificateFile to crt that was signed by CA, not CA cert itself.

Update: A bit more detailed explanation:

You should have 3 files:

  1. Secret key (usually something with .key extension). This is the most important one. You should keep it secret and never ever send to anyone. This file is actually used to encrypt data. You should specify path to this file in SSLCertificateKeyFile directive.

  2. Certificate of your CA. This is public certificate of ceritficate authority that you've used to sign your public key. You should specify path to this file in SSLCACertificateFile directive.

  3. Signed public key. This is public part of your key which you've extracted from key file (in form of certificate request) and send to CA for signing. You should specify path to this file in SSLCertificateFile directive.

2
  • Seems to be some shuffling in the directive names. Mar 17, 2012 at 22:55
  • oh, sorry, fixed
    – rvs
    Mar 18, 2012 at 7:36
0

I never requested a certificate from a "real" CA, in my tests I also created the CA.

But then, in apache2 config I also configured in which path is the CA cert, you may check that, just in case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.