I recently had to renew one of my SSL certificates on an Apache 2.4/Mod_ssl server.

I have 2 Vhosts, no SNI, each running on a separate NIC. Until now the certificates were both Globalsign OrganizationSSL, one specific to an URL, the other one is a wildcard. All this was running fine.

My client wanted to have an Extended Validation SSL. I downloaded the root CA and Intermediate cert required for this chain to operate. But upon switching the certs, my Apache refuses to initialize the chain.

I have the following errors:

  • Apache log: [ssl:emerg] [pid 7394:tid 140377904683136] AH02311: Fatal error initialising mod_ssl, exiting.
  • Vhost log: [ssl:emerg] [pid 7394:tid 140377904683136] AH01903: Failed to configure CA certificate chain!

My Vhost SSL conf:

Vhost 1 (Organization SSL):

SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder     on
    SSLCertificateFile /path/to/organization.crt
    SSLCertificateKeyFile /path/to/server.key
    SSLCertificateChainFile /path/to/intermediate.pem

Vhost 2 (Extended Validation SSL):

SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCACertificateFile /path/to/gs_root_ca.crt
    SSLCertificateChainFile /path/to/intermediate.crt
    SSLCertificateFile /path/to/extended_validation.crt
    SSLCertificateKeyFile /path/to/server2.key

I'm no SSL specialist, and I don't understand why Extended Validation and Organization SSL certs cannot cohabit..

I tried to remove one Vhost and the other, it's working perfectly. So I was forced to disable to least used vhost for my main production backoffice to work.

Have you ever encountered such error? Is it a normal behavior? What can I do to have both my sites running again?

Thanks for your expertise!


You are setting it up incorrectly.

Let's recollect:

  • SSLCertificateKeyFile loads the private key (you are doing this fine)
  • SSLCertificateFile loads the server certificate chain. That is the server certificate and its signing CA's sorted from leaf (certificate) to root (higher lvl CA).
  • SSLCertificateChainFile is deprecated in apache 2.4, so remove this one.
  • SSLCACertificateFile loads the CAs for clients that will authenticate through SSL with client certificate. THIS IS THE ONE YOU WANT TO USE FOR SSL CLIENT AUTH then.

Sidenote: Your Ciphersuite seems very incorrect and insecure at first sight. Worth checking for a change in that one too.

Edit based on comments. For 2.4.6 and earlier you should:

  • SSLCertificateFile loads the server certificate.
  • SSLCertificateChainFile loads the server certificate CA chain.
  • SSLCACertificateFile loads the CAs for clients that will authenticate through SSL with client certificate. THIS IS THE ONE YOU WANT TO USE FOR SSL CLIENT AUTH then.
  • Thanks for all these infos. I saw somewhere that SSLCertificateChainFile was deprecated, but the article talked about apache 2.4.8 and I'm running 2.4.6 so I thought I was not affected. So I can concatenate my website cert, intermediate cert AND the globalsign root CA in the same file? Regarding SSLCACertificateFile, which cert should I enter here? Sorry if my questions are trivial, but I still don't understand clearly the expected certs in each directive... And thanks for your comment on the Ciphersuite, I'll look into it too! – IsKor Jan 16 '18 at 9:51
  • Hello again, I tried to concatenate the certs, but if I do a SSL check, I'm told that the chain is incomplete. However if I run the extendedSSL vhost with my original conf and the second with the concatenated chain the server is running, and my SSL ratings are good (A- and B because incomplete chain). – IsKor Jan 16 '18 at 11:02
  • let me adjust the reply for 2.4.6 then. – ezra-s Jan 16 '18 at 13:07
  • Thank you so much for your answers! I'll try this and let you know. In 2.4.6, can I concatenate the certs? – IsKor Jan 16 '18 at 16:55
  • @J.Aublin Yes, SSLCertificateChainFile IIRC is sorted from root to leaf, but remember, just CA's. And SSLCACertificateFile is concatenated in order of preference. – ezra-s Jan 16 '18 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.