1

I installed an SSL certificate (generated with openssl) on a server running Apache 2.2. After refreshing the config, I saw the site work properly.

However, this morning I discovered that the site was down. After a quick look at the logs, I noticed that Apache was not running and I was not able to restart it.

There were the following errors in the ssl.log

[Tue Oct 10 14:58:48 2017] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

[Tue Oct 10 14:58:48 2017] [warn] RSA server certificate CommonName (CN) `AddTrust External CA Root' does NOT match server name!?

[Tue Oct 10 14:58:48 2017] [error] Unable to configure RSA server private key

[Tue Oct 10 14:58:48 2017] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

Could anyone tell me why this happened? That is, the site worked for several days after the initial configuration. However, at a certain point it broke. How can I troubleshoot this?

Improve this question
2
  • I doubt you generated a cert with OpenSSL that just happens to match an established public root. Do you maybe mean you generated a key and CSR (cert request) with OpenSSL and used the CSR to get a cert from a CA such as Comodo that is under (or bridges under) AddTrust External? Anyway, something is messed up in your files. Look in the Apache config to confirm what files are conifgured for SSLCertificateFile and (probably) SSLCertificateChainFile and look at what is actually in those files. openssl x509 -noout -text <file displays the details of a cert in a PEM file (but only one cert!)
    – dave_thompson_085
    Oct 11, 2017 at 7:54
  • Yes, that is what I mean. I generated a key and then used Comodo to get the certificate.
    – MadPhysicist
    Oct 11, 2017 at 20:03

1 Answer 1

Reset to default
0

Some file did change on disk and/or your Apache configuration has changed. Basically you are configuring Apache with a certificate and key but Apache tells you that they are not related together as they should.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.