The documentation on this directive states the following:

The files in this directory have to be PEM-encoded and are accessed through hash filenames. So usually you can't just place the Certificate files there: you also have to create symbolic links named hash-value.N. And you should always make sure this directory contains the appropriate symbolic links.

I have two questions about this:

  • Practical: What is the .N part in the filename meant for? How do I decide which value to give it?
  • Conceptual: Why doesn't Apache just scan the specified directory for certificate files? Am I missing some property that calculating and remembering the hash of a certificate provides?
  • Practical: It is theoretically possible that two different certificates could be hashed to the same value. In this case, use the extension to be able to keep both certificates around. As long as there's only one certificate using that hash, the extension doesn't matter and you can choose whatever digit you like. (I don't believe I've ever seen anyone use anything other than a 0, but there's no rule against it.)

  • Conceptual: The hash is based on the certificate subject name. The purpose of using it instead of the filename is that when the program (in this case, apache) needs to find a cert, it can ask for the hash of the certificate subject name instead of having to keep an internal table of which file contains which certificate subject name.

man x509 and looking for hash will give you a little more information, but not much.

(Also, you don't actually need to have symlinks - you could also just name the certificate file by its hash name. But having symlinks to "subjectname.pem" will of course make it easier for us humans to figure out which cert is which.)

| improve this answer | |
  • I didn't happen to see the question first time around, otherwise I would have answered it already - so the bounty was useful since it brought the question back up on the front page :-) – Jenny D Mar 11 '14 at 13:27
  • Cheers... Anyway i'll 'award' the bounty as soon as serverfault lets me (in 23 hrs) – Hans Westerbeek Mar 11 '14 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.