41 votes

Can an SSL certificate be on a single line in a file (no line breaks)?

I found this script handy in making the file. awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ca.pem This will take a standard PEM file on multiple lines, replace the "hidden&...
Sankarganesh Eswaran's user avatar
33 votes
Accepted

Why is my SSL certificate untrusted on Android?

Your domain's certificate has two paths to two different root certificate authorities. On modern desktop browsers such as Google Chrome, as well as on newer Android versions, the path being taken is ...
Michael Hampton's user avatar
8 votes

Can an SSL certificate be on a single line in a file (no line breaks)?

It's a standard, and you should follow. The RSA standards (e.g. RFC 2459) only define a binary representation for keys. In practice, like OpenPGP keys (RFC 4880), they are often encoded in base 64 ...
johnnychen's user avatar
8 votes
Accepted

How to check apache for SNI (Server Name Indication ) availability?

The stock CentOS httpd & mod_ssl packages would already have supported SNI. SNI has been supported by openssl since version 0.9.8f and any httpd since version 2.2.12 built with openssl 0.9.8f and ...
HBruijn's user avatar
  • 80.3k
7 votes

How to verify that SSL cipher order is being enforced?

For decent HTTPS configuration analysis you can use https://testssl.sh/ as well. It grants really high quality information of overall HTTPS state. testssl https://yoursite.com In order to check ...
dtrizna's user avatar
  • 71
7 votes
Accepted

How to fix TLS v1.2 issues? (SSL Lab)

The question is not entirely clear, but I'm assuming it boils down to guidance regarding configuration of appropriate TLS cipher suites, etc. That is a question that is tricky to answer well as best ...
Håkan Lindqvist's user avatar
4 votes

How to verify that SSL cipher order is being enforced?

An Nmap EnumCipher script will help you with this nmap --script ssl-enum-ciphers -p I have also set SSLHonorCipherOrder as on, but it shows "cipher preference: client" I was looking for an answer ...
eby mohan's user avatar
4 votes
Accepted

Apache2 - SSL is not working

You are missing the server certificate and on the other hand duplicating some files. I would use the ones below assuming minecraft-multiplayer_com.ca-bundle contains the certificate chain from the ...
Jofre's user avatar
  • 569
4 votes
Accepted

How to solve Apache-2.4 AH02026: Failed to acquire SSL session cache lock

So I've found the root cause of the problem, and the solution. It turns out that there's a bug in Apache2.4 on Ubuntu 14.04 and 16.04 (see https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/...
e_i_pi's user avatar
  • 223
4 votes
Accepted

How to Install mod_ssl on RHEL7 when it's missing from yum

There is no base repository (rhel-7-server-rpms) in the output of your yum repolist I've verified that mod_ssl is found on base RHEL7 repository. Use subscription-manager to re-enable that repo.
kubanczyk's user avatar
  • 14k
3 votes

How to rename default-ssl.conf in Apache 2.4

You need to make sure the new configuration name ends with .conf As this is only a symlink created by the a2ensite command, you probably want to rename to actual configuration file: a2dissite ...
andrekeller's user avatar
3 votes

Understanding relationship between openssl & mod_ssl

MOD_SSL is the interface apache uses to communicate with OpenSSL which is a cryptographic engine. OpenSSL does the work, whilst MOD_SSL provides the functions which allow Apache to use OpenSSLs ...
Mr__ Scalpel's user avatar
3 votes

Can an SSL certificate be on a single line in a file (no line breaks)?

You can convert a one-line certificate string by adding delimiters and wrapping at character 67. ( echo "-----BEGIN CERTIFICATE-----"; echo $CERTIFICATE | sed -e "s/.\{67\}/&\n/...
Ryan's user avatar
  • 135
3 votes

SSL_CLIENT_CERT_CHAIN not being passed to backend server

This is an old question, but I'll answer it in case someone else stumbles upon it like I did. The issuer certificate is actually at position 0 in the chain from Apache, not 1. To get the issuer ...
jbppsu's user avatar
  • 31
3 votes
Accepted

Why is my request queueing time so high?

200ms doesn't seem that terrible. The 'request queuing' metric is the measure of time between your web server logs the request and the moment the New Relic agent loads (after before_filters). The ...
Antonius Bloch's user avatar
3 votes

Apache: SSLCertificateFile: file does not exist or is empty

Note that the message you quoted referred to the Certificate File /var/www/html/licweb/www.licweb.com.crt while everything you mention after "WHAT I TRIED" refers to the Key File. Note also that the ...
RalfFriedl's user avatar
  • 3,148
3 votes
Accepted

When SSL directives takes effect

Welcome to the world of Apache! The first lesson is to learn how to read the excellent documentation. In the Apache documentation, every directive has a context section that indicates where in the ...
Esa Jokinen's user avatar
  • 49.7k
2 votes

Requiring client certificate issued by a specific intermediate CA in Apache

I wanted to authenticate clients with certs issued by sub-CAs of an intermediate CA, i.e. like the following: Root-CA | Intermediate-CA ________|...
Marcel Klehr's user avatar
2 votes

Session Cache is not configured... why?

I tried all the above mentioned solutions and nothing worked in my case. Finally I realized that problem is caused due to "shmcb" which basically refers to apache socache_shmcb module. This ...
sumitrke's user avatar
2 votes

Apache2 with SSL do I have to copy VirtualHost blocks?

As I mentioned on a different question on stackoverflow (https://stackoverflow.com/questions/679383/do-i-have-to-duplicate-the-virtualhost-directives-for-port-80-and-443/52375167#52375167): Another ...
Seb's user avatar
  • 71
2 votes

How to enable SSL only on certain locations

HTTPS needs to be set up at the vhost level since it uses a different port (port 443 versus port 80 for HTTP). So you have to set up HTTPS for the whole site. What you can do is force HTTPS (or even ...
Barry Pollard's user avatar
2 votes
Accepted

mod ssl error during ssl installation

Use SSLCACertificateFile instead of SSLCertificateChainFile. SSLEngine on SSLCertificateKeyFile ./ssls/server.key SSLCertificateFile ./ssls/STAR_domain_com.crt SSLCACertificateFile ./ssls/PositiveSSL....
julio's user avatar
  • 954
2 votes

Apache HTTP to HTTPS redirect not working

Here's an example from a config I wrote in the past using mod_rewrite. <VirtualHost *:80> ServerName www.foo.com ServerAlias foo.com RewriteEngine on RewriteRule ^/(.*) https://%{...
inquam's user avatar
  • 179
2 votes
Accepted

Apache2 uses http instead of https, despite LetsEncrypt

Did https ever work before or stopped working once you switched to Let's Encrypt? Is your server an Amazon EC2 instance? (Potential issue with security groups) This similar question gives some ideas ...
adiuva's user avatar
  • 394
2 votes
Accepted

Something is regenerate ports.conf

After a lot of searching, in my case the cron job task of certbot was modifying the file ports.conf. I disable this job, and renew my certs with certbot -i apache --webroot and entering the path when ...
gokuhs's user avatar
  • 31
2 votes
Accepted

Apache 2.4 / SSL certificates error: AH01903: Failed to configure CA certificate chain

You are setting it up incorrectly. Let's recollect: SSLCertificateKeyFile loads the private key (you are doing this fine) SSLCertificateFile loads the server certificate chain. That is the server ...
Daniel Ferradal's user avatar
2 votes
Accepted

RewriteEngine rules ignored by Apache on SSL

A colleague finally pointed me in the right direction. I found I needed to add RewriteOptions Inherit inside the VirtualHost section of the ssl.conf file. The proxy rules are inherited by default, the ...
nafmo's user avatar
  • 480
2 votes
Accepted

Disabling Apache client certificate validation on a specific page

As this is the top hit when searching for this exact problem and it's rather frustrating to see that there's no answer, I'm gonna comment on a 3 year old thread to spare others that same frustration. ...
Xzenor's user avatar
  • 141
2 votes

Difficulty compiling Apache with --enable-ssl

After some other searching, it appears that libssl-dev was also required. Installing that and then running configure resolved the issue.
Eddie Rowe's user avatar
2 votes
Accepted

Red Hat 8: Is 'mod_ssl' missing in official repositories?

I found that the module mod_ssl is missing ... I simply tried yum install mod_ssl which match no repository in Red Hat 8. I am not able to reproduce your observation. In an almost out-of-box ...
U880D's user avatar
  • 1,170

Only top scored, non community-wiki answers of a minimum length are eligible