My company is hosting example.com and sub.example.com on the same server, using a wildcard SSL certificate for *.example.com. Now it's time to renew our certificate, and we're not sure how we got that certificate. My boss doesn't think we paid the $200 that they appear to cost. My old manager (who left the company a few days ago) was the one to install it, and he doesn't remember exactly what he did, but he thinks he had to generate something instead of just using files we were given by the CA.
The apache config has these lines, and no other uncommented SSL*File lines:
SSLCertificateFile /usr/local/ssl/cert/example.com.crt SSLCACertificateFile /usr/local/ssl/cert/intermediate.crt SSLCertificateKeyFile /usr/local/ssl/private/example.com-wild.key
When I examine intermediate.crt (
openssl x509 -in intermediate.crt -text -noout), it doesn't mention our organization or website at all, and it's valid 2010-2020.
Data: Version: 3 (0x2) Serial Number: 145105 (0x236d1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA Validity Not Before: Feb 19 22:45:05 2010 GMT Not After : Feb 18 22:45:05 2020 GMT Subject: C=US, O=GeoTrust, Inc., CN=RapidSSL CAb
example.com.crt is the wildcard:
Data: Version: 3 (0x2) Serial Number: 1113972 (0x10ff74) Signature Algorithm: sha1WithRSAEncryption Issuer: C=US, O=GeoTrust, Inc., CN=RapidSSL CA Validity Not Before: Mar 1 09:05:39 2014 GMT Not After : Mar 4 09:08:54 2015 GMT Subject: serialNumber=T0nuTvfeaQVtd3dZ30zGI94HrvUsoRjx, OU=GT53409919, OU=See www.rapidssl.com/resources/cps (c)14, OU=Domain Control Validated - RapidSSL(R), CN=*.example.com
I don't understand SSL infrastructure, so I guess I have a bunch of related questions. I apologize if they turn out not to be at all related; I don't know what I don't know.
How did we get the wildcard certificate, if we didn't pay $200 or whatever for it? (I'd be moderately surprised if we could have created it with just intermediate.crt, because then we could keep generating them until 2020. But there are no other files in /usr/local/ssl, and nothing in /etc/pki/tls that's been modified since 2013, so what else would we have used? I'd also be moderately surprised if my boss is just misremembering and we did pay $200 or something, but that does seem possible to me.)
Where did we get intermediate.crt?
What does intermediate.crt do? I have a self-signed wildcard certificate that works fine (except that it's self-signed) on our beta servers, with no SSLCACertificateFile line; and we've bought a non-wildcard certificate that protects example.com which I've managed to install using VirtualHost with no SSLCACertificateFile, and we're in the process of getting a certificate for sub.example.com which I'm planning to install the same way. Is the SSLCACertificateFile needed for non-self-signed wildcard certificates?
The way I generated the self-signed cert feels like it might be related:
openssl req -nodes -new -keyout private/example.com.key -out certs/intermediate.csr openssl x509 -req -days 365 -in certs/intermediate.csr -signkey private/file.key -out certs/example.com.crt
but I don't need to mention intermediate.csr in the apache config in this case, and intermediate.csr can't be examined by
openssl x509like the intermediate.crt file can.