1

I am replacing our SSL cert on our Apache web server.

This is the first time I have done this, with my 2 colleagues being on holiday, and an urgent need to replace our SSL cert(due to the openssl bug), Would someone mind giving me some pointers.

I have read up but just want to double check the following procedure is correct

I have generated a new private key, and CSR. Have sent the CSR to the CA, they have now issued me with a new crt and ca-bundle file.

Do I simply replace the private key,the new crt and the new ca-bundle and restart httpd?

Are there any other tasks that need to be carried out before doing this?

1
  • Besides the obvious, but often overlooked, back-up before you start, no. That should be it. You might want to verify the new certificate matches the hostnames (Subject and possibly additional X509v3 SubjectAltName names) of the old one with openssl x509 -text -in cert.pem
    – HBruijn
    Apr 9, 2014 at 12:14

1 Answer 1

1

You've already done the hard work. And you're correct in that you need to replace BOTH the private key as well as the certs that have been re-issued to you.

All you need to do now is replace the old key files with the new crt and ca-bundle.

And yes, you DO have to restart Apache (httpd). If you're unsure of having it take or not, consider rebooting the entire machine too.

Of course, all of this is a moot point if you didn't patch your system first. So, steps in the proper order would be:

  • Patch your System (install fixed version of OpenSSL)
  • Restart Apache
  • Generate new Private Key
  • Obtain the new CRT from the CA
  • Replace your certificates
  • Restart Apache (or better yet, restart your whole server)
4
  • Thanks for the advice... So I copies the files as above, restarted httpd but got an error:SSL Library Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch. This would suggest to me that the private key does not match the certs sent over by CA. I am 100% sure that the i'm using the private key that openssl spat out when generating the csr. Any ideas?? Apr 9, 2014 at 13:06
  • I have just put the old keys back in pace and now is all fine. I have just seen HBrujin's comment... I will perform the check suggested now Apr 9, 2014 at 13:12
  • Ok so checked the cert I received, the X509v3 Subject Alternative Name are correct, I cant see a hostname section in there though, but this matches the origional, I can see the hostname in the "subject" though... CN={hostname} Apr 9, 2014 at 13:31
  • OK, so ran openssl x509 -noout -modulus -in server.crt | openssl md5 and openssl rsa -noout -modulus -in myserver.key | openssl md5 .... The Modulus do not match :( . I'm not sure what happened here. I do not have any other private keys/csr's on the server except the ones that are currently used in production scratches head Has anyone had any similar issues when changing ssl certs? I am thinking maybe I entered some of the OU details, that openssl prompts for, incorrectly? But surely the private and public should still match? I have requested new cert. Thanks again for your comments Apr 9, 2014 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .