1

I recently purchased and set up a VPS, and one of the first steps I took was to purchase and install an SSL Certificate. I had issues getting everything set up, but after quite a bit of research and head pounding it was finally set up correctly. I had a rewrite in the .htaccess file that forced https connections. Everything was sunshine and lolly-pops. Then came heartbleed!

I had my SSL certificate reissued, and created new private keys. I then followed these steps to create a chained file. Now, when I try to start apache2, I'm getting the following error:

[Mon Apr 28 10:32:59 2014] [warn] RSA server certificate CommonName (CN) `example.com' does NOT match server name!?
[Mon Apr 28 10:32:59 2014] [error] Unable to configure RSA server private key
[Mon Apr 28 10:32:59 2014] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

What exactly does that mean? The certificate was just reissued, so there shouldn't have been any changes to the server name. Did I flub making the chain file?

Other Information

Ubuntu 12.04 LTS, with Apache 2.2.22. Oddness: I updated OpenSSL, and had no issues, prior to reissuing the cert. Now openssl version returns "OpenSSL 1.0.1 14 Mar 2012". Furthermore, I went to this checker and this checker after setting everything back up, and got a clean bill of health for both. However, I don't think I ever restarted apache after changing the certificates.

Thoughts, advice, and guidance are appreciated!

Update

In my default-ssl I have it pointing to the following:

    SSLCertificateFile /etc/apache2/ssl/developingawesomeness.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/developingawesomeness.com.key
    SSLCertificateChainFile /etc/apache2/ssl/developingawesomeness.com.chain.pem

Those files are in those directories as well.

  • You have correctly updated both the certificate file and the keyfile, yes? I'm a bit suspicious about the way you say "I had my SSL certificate reissued, and created new private keys"; you didn't really do it in that order, did you? – MadHatter supports Monica Apr 28 '14 at 15:03
  • 2
    I had my SSL certificate reissued, and created new private keys. In that order? That sounds like you crated a CSR with the old key and then switched the private key to a new one. – faker Apr 28 '14 at 15:03
  • That might be it, but I'm pretty sure I misspoke on that. I used openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr to generate a new csr, and used that to get the new cert. – Matthew Johnson Apr 28 '14 at 15:05
  • Is there a way to check the common name on the csr to verify that it matches the actual domain name? – Matthew Johnson Apr 28 '14 at 15:06
  • 2
    To see the embedded CN (and more), do openssl x509 -in server.crt -noout -text. – MadHatter supports Monica Apr 28 '14 at 15:36
1

I'm not sure what the issue was exactly, but I created yet another csr and had my certificate re-reissued. Comodo actually sent different files than they had previously. Starting from scratch and chaining the necessary files fixed the issue.

-1

problem was private key. In apache server, if you create private key with passphrase then server will not start properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.