1

Hi I'm trying to renew my SSL certificate and Apache refuses to start when I change the paths to the new certificate file. I'm running Apache 2.2 on CentOS 6.6.

When I try to start Apache this is in /var/log/httpd/ssl_error_log:

[Sun Dec 07 20:00:29 2014] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Dec 07 20:00:29 2014] [warn] RSA server certificate CommonName (CN) `proposify' does NOT match server name!?

It's a wildcard certificate for *.domain.com (same as before). What am I doing wrong?

Thanks!

[ edit ]

One thing I noticed is in the new private key has more info at the top and the old one just has the key. Should I remove the info so the actual key starts under -----BEGIN RSA PRIVATE KEY-----?

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: NUMBER,NUMBER

... long string of numbers/chars ....

The original files were in:

/etc/httpd/conf.d/ssl/domain.com

The new files are in:

/etc/httpd/conf.d/ssl/domain

So in my VHOST all I'm doing is removing the ".com" in the key, certificate, and chainfile entries. The private key, certificate, and intermediate certificate all have the same names as before. I ran cat on them all to confirm they have the correct contents.

4
  • 1
    You seem to have put the wrong certificate in the wrong configuration directive. Check everything again. – Michael Hampton Dec 7 '14 at 20:25
  • Run apache2ctl configtest for concrete hints. – jpe Dec 7 '14 at 20:27
  • Show's Syntax OK. – Jonathan Dec 7 '14 at 20:28
  • Where's the certificate from - internal CA or a public one? – Shane Madden Dec 7 '14 at 23:07
3

... to renew my SSL certificate ...

[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[warn] RSA server certificate CommonName (CN) `proposify' does NOT match server name!?

It's a wildcard certificate for *.domain.com (same as before). What am I doing wrong?

Your statements do not match with the error messages. Since you are renewing the certificate is probably not self-signed, so it should not be a CA certificate as shown by the warning message. Also, the second warning shows that the certficate does not seem to match the hostname.

Please check the contents of your certificate files with openssl x509 -text or similar tools.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.