5

About 2 weeks ago I bought a new wildcard SSL certificate for all of my servers, and immediately tried to set it up on a server by replacing the old self-signed certificate settings. So, I put in the new details, restarted apache, and refresh my browser, and it's still complaining about having a self-signed SSL certificate. So I investigate further, and confirm it's not my browser or local cache by testing it from a remote windows server, but it is still serving the old self-signed certificate (but the chainfile has updated successully). I even tried rebooting the server to attempt to clear apache's SSL cache or whatever is going on, but no luck there either.
And for some crazy reason, it works fine on port 444, if I edit that site and change it to port 443, it goes back to the old certificate .... :( what's going on? it's not just port 443 that doesn't work by the way, i've tested ports 92XX (as thats what my services run on) and it gets the same errors, even after creating a new site on a new port. I also tried copying one of the sites to another (new, never had ssl before) server and it works fine there :/
How do I clear apache's "SSL cache" or whatever is going on here (running Ubuntu 12.10 Server)?

Configuration of one of the sites:

<IfModule mod_ssl.c>
<VirtualHost *:9207>
        DocumentRoot /var/www/ssl/
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/ssl/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>
        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>
        ErrorLog /var/log/apache2/error.log
        LogLevel warn
        CustomLog /var/log/apache2/ssl_access.log combined
        Alias /doc/ "/usr/share/doc/"
        <Directory "/usr/share/doc/">
                Options Indexes MultiViews FollowSymLinks
                AllowOverride None
                Order deny,allow
                Deny from all
                Allow from 127.0.0.0/255.0.0.0 ::1/128
        </Directory>
ProxyPass /tr http://localhost:9107/tr
ProxyPassReverse /tr http://localhost:9107/tr
        SSLEngine on
        SSLCertificateFile    /etc/ssl/crt/STAR_mysite_net.crt
        SSLCertificateKeyFile /etc/ssl/crt/server.key
        SSLCertificateChainFile /etc/ssl/crt/STAR_mysite_net.ca-bundle
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch ".*MSIE.*" \
                nokeepalive ssl-unclean-shutdown \
                downgrade-1.0 force-response-1.0
</VirtualHost>
</IfModule>
4
  • 2
    Could you post your configuration? Edit your post, hit enter twice, paste the configuration, and then highlight all of it and choose "block quote". (the double enter is important)
    – Andrew B
    Jan 8, 2013 at 23:45
  • Do you have any web proxies or transparent internet filters in the mix? Are you pointing directly to the server or going through a load-balancer?
    – Mike B
    Jan 9, 2013 at 0:21
  • Okay, I've added the configuration of one of the sites, @MikeB, as you can now see it does use ProxyPass, could that be a problem? If so, what do I need to do to update the SSL cert? (the site on port 444 doesn't use ProxyPass)
    – Sbx
    Jan 9, 2013 at 10:57
  • 1
    Your configuration does not match your text. You have it for ports 9207 and 9107 while you speak in your text about ports 443 and 444. What remains is that Apache will read your certificates at the time it starts. There is no other cache than that at Apache. And if you gave the website name people could have tried to see which certificate they get. Aug 17, 2018 at 15:44

5 Answers 5

4

Run this function as root on your linux server:

apachectl graceful

works for me on debian. If that is not working you can try parameter -k

apachectl -k graceful

error messages in dutch chrome: Fout met SSL-verbinding

error message in english chrome: Error with SSL connection

2
  • The user already said he restarted Apache. Aug 17, 2018 at 15:43
  • This did not fix the issue but it did give some additional information about an apache configuration issue.
    – 6006604
    Jul 31, 2020 at 14:47
1

I've been struggling with this for hours, the problem for me was that were multiple apache instances running and "service apache restart" don't stop them, and they were serving the old certificate.

The solution was:

service apache2 stop
pkill apache2
service apache2 start
1

I thought that I had a cert caching issue but it was all an issue with setup.

validate setup with

apachectl -S

and then make sure everything with port 443 has your new valid cert.

0

apachectl graceful didn't work for me. Adding -k didn't work either.

I had to simply move the old certificate out from the certs directory, retarted apache and it finally worked.

mv /etc/ssl/certs/STAR_site.crt ~/bkp/
apachectl restart

I think this was the solution for me, I was also messing around with Cloudflare and disabled Universal SSL, and reenabled it for a different domain. Universal SSL was reestablished just as I removed the old cert. So, i'm not 100% certain the above is what did the trick, or toggling Cloudflares Universal SSL.

-1

"rcapache2 graceful" + "rcapache2 restart" on Opensuse.

1
  • 2
    The user already said he restarted Apache. Aug 17, 2018 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .