Mod ssl error during ssl installation

apache-2.2mod-sslssl-certificate

Server Environment
AWS EC2, Ubuntu 14.04LTS, LAMP

443 Port is enabled from security group. Server is listening to 443 port.

I have purchased SSL from cheapsslsecurity.com and followed following step.

step 1 : create a bundle

cat COMODORSADomainValidationSecureServerCA.crt COMODORSAAddTrustCA.crt AddTrustExternalCARoot.crt > PositiveSSL.ca-bundle

Step 2 : Edit site conf file

<VirtualHost *:443>

    ServerAdmin info@domain.com
    ServerName www.domain.com
    ServerAlias www.domain.com
    DocumentRoot /var/www/public_html/domaincom

    SSLEngine on
    SSLCertificateKeyFile ./ssls/server.key
    SSLCertificateFile ./ssls/STAR_domain_com.crt
    SSLCertificateChainFile ./ssls/PositiveSSL.ca-bundle

</VirtualHost>

Step 3 : Restart the server

Then following error is coming :

[Sat Apr 23 10:50:14.668246 2016] [ssl:emerg] [pid 32733] AH02238: Unable to configure RSA server private key
[Sat Apr 23 10:50:14.668348 2016] [ssl:emerg] [pid 32733] SSL Library Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
[Sat Apr 23 10:50:14.668354 2016] [ssl:emerg] [pid 32733] AH02312: Fatal error initialising mod_ssl, exiting.

With respect to above error, I did some research as follows

Same value is coming for both

openssl x509 -noout -in STAR_domain_com.crt | openssl md5

openssl rsa -noout -in server.key | openssl md5
put following line in /etc/apache2/sites-available/default-ssl.conf

SSLCertificateChainFile ./ssls/PositiveSSL.ca-bundle
Many more things listed on www.google.com 🙁
Each time i restart the apache, getting the same error.

Anything out there?

Best Answer

Use SSLCACertificateFile instead of SSLCertificateChainFile.

SSLEngine on
SSLCertificateKeyFile ./ssls/server.key
SSLCertificateFile ./ssls/STAR_domain_com.crt
SSLCACertificateFile ./ssls/PositiveSSL.ca-bundle

Also, be sure that they are in the correct directories accessible by Apache. You can also transfer your certificates to /etc/ssl/private to double check.

Related Solutions

Ssl – how to download the ssl certificate from a website

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Ssl – Apache SSL Installation

If it's barking that 'SSLCertificateFile' is a invalid directive, then you don't have mod_ssl loaded. You need a line somewhere in your config that looks similar to this:

LoadModule ssl_module   libexec/apache22/mod_ssl.so

(That particular line is from a FreeBSD box, so it's unlikely to work without minor modification)

You should usually put the SSL information in the vhost's directive; but a very simple site could go something like this:

ServerName example.com

Listen 80
Listen 443

LoadModule ssl_module   libexec/apache22/mod_ssl.so
LoadModule the other modules go in here...

User www
Group www

DocumentRoot /path/to/site

SSLCertificateFile /path/to/cert
SSLCertificateKeyFile /path/to/key
SSLCertificateChainFile /path/to/chain

<VirtualHost *:443>
    SSLEngine on
</VirtualHost>

This is what the config for my person site looks like (plus some security, logging, and other junk like that).

Best Answer

Related Solutions

Ssl – how to download the ssl certificate from a website

Ssl – Apache SSL Installation

Related Topic