0

Apache (2.4, both versions .20 and .23) is sending the following waring to my error log:

[Tue Oct 04 09:17:02.438371 2016] [ssl:warn] [pid 55157:tid 140100469708544] AH01909: <host>:<port>:0 server certificate does NOT include an ID which matches the server name

However, when I go to https://host:port/... with Google Chrome, I get the green lock, and clicking on it and looking at the server information gives all the correct information about my server.

Is this an apache bug? A failure of my understanding?

##
## SSL Virtual Host Context
##

<VirtualHost _default_:<port>>
DocumentRoot "<the path>"
ServerName <host>:<port>

Should I replace "default" with my host name?

openssl x509 -in [cert file] -noout -subject

-->

subject= .../OU=PlatinumSSL/CN=[host]

So I have defined the server name correctly in the conf file, and the certificate has the host name correctly listed.

Improve this question

1 Answer 1

Reset to default
1

This is just a warning.

It is logical that you define the directive ServerName to specify which url you are serving, when you configure a certificate, httpd will match the name in ServerName against the CN in the certificate you are using.

This won't prevent httpd from running since it is not a fatal error or anything, but it just warns you because clients will complain.

About the VirtualHost directive, do not define names in it, names should be defined in ServerName as I mentioned above.

So briefly: make sure ServerName and CN or SAN in certificate match.

You can use this command to check the CN in your certificate: openssl x509 -in /path/to/cert.crt -noout -subject

Also, if your certificate is a wildcard, the sane thing to do would be to define these directives in your virtualhost:

Servername example.com
ServerAlias *.example.com
Improve this answer
7
  • ServerName and CN match. I added that information to my question
    – Greg Dougherty
    Oct 4, 2016 at 20:01
  • "This won't prevent httpd from running since it is not a fatal error or anything, but it just warns you because clients will complain" The thing is, Google Chrome does NOT complain. It thinks everything is just fine
    – Greg Dougherty
    Oct 4, 2016 at 21:13
  • 1
    Well, without seeing the actual data I can't tell you anything else aside from the extra ":0" in the error from Apache HTTPD looks odd "AH01909: <host>:<port>:0 server certificate". But anyways, if your client browser does not complain, just ignore it.
    – Daniel Ferradal
    Oct 5, 2016 at 14:11
  • 1
    httpd will match the name in ServerName against the CN.. Note that RFC 2018 deprecated the use of Common Name as identifying the server - back in May, 2000. And RFC 6125 says the Common Name shall be ignored if SANs are present: "As noted, a client MUST NOT seek a match for a reference identifier of CN-ID if the presented identifiers include a DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types supported by the client."
    – Andrew Henle
    Sep 3, 2021 at 7:01
  • @AndrewHenle thanks for the clarification. As you pointed out and AFAIK apache does take into account RFC 2018. So we should assume in cases like the question above, not the SAN and nor the CN matched the requested host name.
    – Daniel Ferradal
    Sep 4, 2021 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.