3

Our server was upgraded yesterday so it now has a more updated Ubuntu, Apache 2.4.10, PHP etc. After I put everything back, Apache started complaining about my configuration.

The server hosts a site which is using wildcards for dynamic content for different customers and contains 3 wildcard certificates for different services for these customers.

A part of the config with a wildcard looks like this:

<VirtualHost *:80>
    ServerName *.dashboard.example.com
    ServerAlias *.dashboard.example.com
    RewriteEngine On
    RewriteCond %{HTTP_HOST} ^(.+)\.dashboard.example\.com$
    RewriteRule ^/(.*)$ https://%1.dashboard.example.com/$1 [R=302,L]
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin webmaster@example.com
    ServerName *.dashboard.example.com
    ServerAlias *.dashboard.example.com
    DocumentRoot /var/www/dashboard.example.com/web

    <Directory />
        AllowOverride All
        Options -Indexes +MultiViews +FollowSymLinks
        Order Deny,Allow
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/dashboard.example.com-error.log
    CustomLog /var/log/apache2/dashboard.example.com-access.log combined

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/bundle_wc_dashboard_example_com.crt
    SSLCertificateKeyFile /etc/ssl/certs/wildcard_dashboard_example_com.key
</VirtualHost>

Note that I'm using a bundle as a certificate file. Using separate files for the intermediate and root files results in an even worse result when using SSL checks. The GeoTrust certificate is then not recognised. My SSL certificate supplier explaind as of Apache 2.4, the certificates should be bundles.

So this does not work for me:

SSLCertificateFile /etc/ssl/certs/wildcard_dashboard_example_com.crt
SSLCertificateKeyFile /etc/ssl/certs/wildcard_dashboard_example_com.key
SSLCertificateChainFile /etc/ssl/certs/GeoTrust_Global_CA.crt
SSLCertificateChainFile /etc/ssl/certs/RapidSSL_SHA256_CA_G3.crt

The above however, did work on Apache 2.2.

When I try to start apache it complains about the ServerName value:

[FAIL] Reloading web server: apache2 failed!
[warn] The apache2 configtest failed. Not doing anything. ... (warning).
Output of config test was:
AH00526: Syntax error on line 42 of /etc/apache2/sites-enabled/3-production.conf:
Invalid ServerName "*.dashboard.example.com" use ServerAlias to set multiple server names.
Action 'configtest' failed.
The Apache error log may have more information.

So it seems the asterisk is not allowed. If I remove the asterisk, apache starts, but an error appears in the domain's error log:

Fri Mar 11 10:32:13.821304 2016] [ssl:warn] [pid 18019] AH01909: dashboard.example.com:443:0 server certificate does NOT include an ID which matches the server name

From other sources I found the following command, which should be used to determine the CommonName which should be used as ServerName:

openssl x509 -in wildcard_dashboard_example_com.crt -noout -subject

Which returns:

subject= /CN=*.dashboard.example.com

My browser does show a green lock, but SSL checks complain I'm missing an intermediate/chain certificate file (see screenshot). The same problem occurs on the same server for 2 other wildcard domains and 1 normal subdomain which isn't a wildcard. Even there apache claims server certificate does NOT include an ID which matches the server name. The site is using wildcards for dynamic content for different customers and contains 3 wildcard certificates for different services for these customers.

Any idea on how I can fix this? Anything else I can do to check what's wrong?

Failed SSL check

Update May 18 2016

I fixed this at the start of April. It appeared that the company who provided the SSL certificates gave us an old root certificate. They mailed me a zip containing both a bundled certificate and and separate certificate files. I tried installing these multiple times. Then I compared the contents of all the files manually with other sites that did work. I noticed a difference and re-downloaded the certificates manually from their site.

The GeoTrust certificate was different. After installing it everything worked like a charm. My boss told me he would contact them about this, but unfortunately this never happened. Happy it's working now anyway.

  • 1
    If the certificate is valid for specifically only *.example.com, it's not valid for example.com. Does it work when you specify eg foo.example.com as ServerName? There's also some mismatch for names including api and dashboard, is that a real issue or are those different certs discussed in the same question? – Håkan Lindqvist Mar 11 '16 at 10:03
  • Sorry no, mismatch on my side. The wildcard domains are *.dashboard.example.com, *.api.example.com and *.invite.example.com. The issue occurs on all domains. I'll check for foo.example.com – ar34z Mar 11 '16 at 10:06
  • Just to be absolutely clear my comment about foo.example.com <-> *.example.com would result in something like foo.dashboard.example.com in the context of your question. – Håkan Lindqvist Mar 11 '16 at 10:08
  • If I use test.dashboard.example.com as ServerName, the error (server certificate does NOT include an ID which matches the server name) does no longer appear in Apache error log. However, the SSL check still says I'm missing a chain certificate file. – ar34z Mar 11 '16 at 10:12
  • I think I must somehow get Apache to work with the wildcard name using an asterisk as ServerName and that will fix the SSL checks. – ar34z Mar 11 '16 at 10:16
3

If the certificate is valid for specifically only *.dashboard.example.com, it's not valid for dashboard.example.com (the latter does not match the wildcard).

ServerName is used to specify the canonical name (one single name) for the site.
Additional names and wildcards only go into ServerAlias.

Setting eg ServerName foo.dashboard.example.com should work (in combination with the ServerAlias you have).


Regarding the mentioned issues with the certificate chain, these do not appear to be related to the actual question.
I would suggest ensuring that all required intermediate certificates are correctly bundled.

As you noted SSLCertificateChainFile is obsolete, you do not need to use it, you can just put all the certificates in SSLCertificateFile.

The Qualy's SSL Labs test can be used for seeing if any intermediate certs are missing or if there are other issues.

  • You are right about the ServerName property. It works, but is it the correct way? Theoretically, if I'm at bar.dashboard.example.com and my ServerName is set to foo.dashboard.example.com - it just doesn't seem right to me. Bu tif Apache is happy, I'm happy. No all I need to do is satisfy those SSL checks :) Thank you for your help so far. – ar34z Mar 11 '16 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.