LinuxQuestions.org - [SOLVED] ssl.conf and multiple ssl certificastes on Apache

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - ssl.conf and multiple ssl certificastes on Apache (https://www.linuxquestions.org/questions/linux-server-73/ssl-conf-and-multiple-ssl-certificastes-on-apache-799955/)

kaoticsnow

04-04-2010 11:45 AM

ssl.conf and multiple ssl certificastes on Apache

I'm trying to set up a 2nd SSL cert on a different domain on a server, each domain has its own IP address, the problem is the Web developer that configured the first domain specified ssl keys for the primary domain in both the vhost config in httpd.conf AND in the ssl.conf config files. If I attempt to remove the keys form ssl.conf the server will not start up. and with them there It will not start up if I specify keys for the secondary domain. any ideas would be much apreciated.

ssl.conf

Code:

LoadModule ssl_module modules/mod_ssl.so

SSLCertificateFile /etc/pki/tls/certs/primary.com.crt

SSLCertificateKeyFile /etc/pki/tls/certs/primary.com.key 

SSLCertificateChainFile /etc/pki/tls/certs/primary_gd_bundle.crt

bathory

04-04-2010 01:31 PM

Hi,

In general you can setup an IP based ssl vhost like this:
<VirtualHost 1.1.1.1:443>
ServerName vhost1.domain.com
DocumentRoot /path/to/vhost1/docroot
...
SSLEngine on
SSLCertificateFile /path/to/certs/vhost1.crt
SSLCertificateKeyFile /path/to/certs/vhost1.key
...
</VirtualHost>
I guess you cannot remove the keys from ssl.conf, because the existing vhost is the default one, but without ssl.conf and httpd.conf (or at least the relevant parts of them) we cannot tell for sure.
You should take a look at error_log for details.

kaoticsnow

04-04-2010 01:40 PM

Quote:

Originally Posted by bathory (Post 3923976)

without ssl.conf and httpd.conf (or at least the relevant parts of them) we cannot tell for sure.
You should take a look at error_log for details.

I've looked at the error log and its simply complaining about not finding the keys for the primary domain when I remove them from ssl.conf which confuses me because they are defined in httpd.conf, which portions of each confings do you need to see I'll grab them and post them, (after stripping sensitive information).

bathory

04-04-2010 02:07 PM

As a start, post the existing vhost definition, the ssl related stuff in httpd.conf and the ssl.conf.

kaoticsnow

04-04-2010 09:40 PM

Quote:

<VirtualHost xx.xx.xx.1:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/primary.com.crt
SSLCertificateKeyFile /etc/pki/tls/certs/primary.key
SSLCertificateChainFile /etc/pki/tls/certs/primary_gd_bundle.crt
<Directory /var/www/sites/primary.com>
AllowOverride All
</Directory>
DocumentRoot /var/www/sites/primary.com
ServerName primary.com
DirectoryIndex "index.php"
</VirtualHost>

<VirtualHost xx.xx.xx.2:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/secondary.com.crt
SSLCertificateKeyFile /etc/pki/tls/certs/secondary.key
SSLCertificateChainFile /etc/pki/tls/certs/secondary_gd_bundle.crt
<Directory /var/www/sites/secondary.com>
AllowOverride All
</Directory>
DocumentRoot /var/www/sites/secondary.com
ServerName secondary.com
DirectoryIndex "index.php"
</VirtualHost>

If I comment out the code in ssl.conf where the web guy specified the primary domains keys I can run a config check and it says its okay

Quote:

LoadModule ssl_module modules/mod_ssl.so
#SSLCertificateFile /etc/pki/tls/certs/primary.com.crt
#SSLCertificateKeyFile /etc/pki/tls/certs/primary.com.key
#SSLCertificateChainFile /etc/pki/tls/certs/primary_gd_bundle.crt

Quote:

[web01:~]$ apachectl -t (04-04 19:34)
Syntax OK

But appache will fail to start unless I uncomment the key files again.

bathory

04-05-2010 03:43 AM

Hi,

Do the 2 vhosts work when you leave uncommented the sslcertificate directives in ssl.conf?
Is this snippet, defining the 2 vhosts inside httpd.conf?
Have you tried moving the ssl vhosts part into ssl.conf?
This is at least, how ssl vhosts are defined in my apache.

kaoticsnow

04-05-2010 11:21 AM

Quote:

Originally Posted by bathory (Post 3924545)

Not when I have the primary key's defended in ssl.conf I'll try moving the vhost to ssl.conf and see what happens.

gumaheru

04-05-2010 11:43 AM

The ssl.conf file has a "VirtualHost" definition. If you want to comment out the keys portion in this file you need to comment out the whole "VirtualHost" definition. Comment from "<VirtualHost>" to "</VirtualHost>". I came across this issue lastweek when adding a SSL cert to a host that had a key previously defined by the last admin.

kaoticsnow

04-05-2010 12:05 PM

Quote:

Originally Posted by gumaheru (Post 3924973)

Thanks for pointing that out! I think that might be it, going to play with it now and try it out.

I just attempted bathory's suggestion of moving the vhost definitions into the ssl.conf file but upon a reload of httpd it reloaded successfully and the site stopped working, this was in the error log after the reload, I restored original files and restarted the server to get everything back working.

Code:

[Mon Apr 05 09:54:32 2010] [error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]

kaoticsnow

04-05-2010 12:13 PM

Quote:

Originally Posted by gumaheru (Post 3924973)

one more question before I start modifying this, I was thinking this was just default settings and anything not defined here httpd would accept the values defined in httpd.conf am I mistaken in assuming this? if I get rid of it should I move over the relevant variables which are not defined in httpd.conf, such as error log locations? Thanks again!

bathory

04-05-2010 01:17 PM

I think that the current apache configuration does not support IP-based vhosts
What is the output of:

Code:

apachectl -S

kaoticsnow

04-05-2010 01:40 PM

Quote:

Originally Posted by bathory (Post 3925094)

I think that the current apache configuration does not support IP-based vhosts
What is the output of:

Code:

apachectl -S

Strange when running that I get

Code:

Syntax error on line 13 of /etc/httpd/conf.d/ssl.conf:

SSLCertificateFile: file '/etc/pki/tls/certs/primary.com.crt' does not exist or is empty

but its working on the primary domain, then again this is all also specified under the vhost in httpd.conf, also I have the IP based vhost working, you can go to primary.com and secondary.com and they pages pull up fine, however only https://primary.com is working I cant get ssl working on secondary.com

(obviously I'm swapping actual domain names with primary and secondary)

bathory

04-05-2010 01:56 PM

Are you sure that both httpd.conf and ssl.conf use the same SSLCertificateFile (/etc/pki/tls/certs/primary.com.crt) and that the apache user can read the certificate?

Code:

ls -l /etc/pki/tls/certs/primary.com.crt

Also what gives

Code:

openssl verify /etc/pki/tls/certs/primary.com.crt

kaoticsnow

04-05-2010 02:39 PM

Quote:

Originally Posted by bathory (Post 3925149)

Are you sure that both httpd.conf and ssl.conf use the same SSLCertificateFile (/etc/pki/tls/certs/primary.com.crt) and that the apache user can read the certificate?

Code:

ls -l /etc/pki/tls/certs/primary.com.crt

Code:

web01 ~ # grep SSLCertificateFile /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/tls/certs/primary.com.crt



web01 ~ # grep SSLCertificateFile /etc/httpd/conf/httpd.conf

SSLCertificateFile /etc/pki/tls/certs/primary.com.crt

Quote:

Also what gives

Code:

openssl verify /etc/pki/tls/certs/primary.com.crt

Code:

web01 ~ # openssl verify /etc/pki/tls/certs/primary.com.crt 

/etc/pki/tls/certs/primary.com.crt: /O=www.primary.com/OU=Domain Control Validated/CN=www.primary.com

error 20 at 0 depth lookup:unable to get local issuer certificate

bathory

04-05-2010 05:13 PM

You didn't post the output of

Quote:

ls -l /etc/pki/tls/certs/primary.com.crt

Anyway the certificate looks ok, so I guess it's something else. Maybe a SELinux problem.
What distro are you using and what apache version?
If you comment out the 2 ssl lines from ssl.conf what gives "apachectl -S"?

kaoticsnow

04-05-2010 11:47 PM

Server version: Apache/2.2.3
Server built: Mar 27 2010 13:52:09

and I'm running CentOS 5

Code:

ls -l /etc/pki/tls/certs/primary.com.crt

-rwxr-xr-x 1 apache apache 1931 Jan  8 22:56 /etc/pki/tls/certs/primary.com.crt

Thanks again for all the help you guys have been giving =D

Also selinux is disabled.

bathory

04-06-2010 03:34 AM

I'm not familiar with Centos, so cannot tell what's wrong with your setup.
Reading the documentation here and here, I saw that it uses the key/cert files in both the main and the vhost part of the configuration. I guess this is done because it somehow it defines a default ssl vhost.

Are you sure you don't have a _default_server (or wildcard server "*:443) that needs the certificates be in /etc/pki/tls/certs.
Without the output of "apachectl -S", we cannot be sure if that's the case. You can check the *.conf files for something like: "<Virtualhost _default_:443>" or "<VirtualHost *.443>

Regards

kaoticsnow

04-06-2010 12:35 PM

There is a default section in ssl.conf, here is what my ssl.conf contains: http://pastebin.com/33Z3mP6p pretty much the default I'm pretty sure all the guy before me did was add the key files here. also after commenting out the files I get the following with apachectl -S

Code:

VirtualHost configuration:

<primaryIP>:443    primary.com (/etc/httpd/conf/httpd.conf:1041)

wildcard NameVirtualHosts and _default_ servers:

*:443                  is a NameVirtualHost

        default server web01.primary.com (/etc/httpd/conf.d/ssl.conf:84)

        port 443 namevhost web01.primary.com (/etc/httpd/conf.d/ssl.conf:84)

*:80                  is a NameVirtualHost

        default server primary.com (/etc/httpd/conf/httpd.conf:1021)

        port 80 namevhost primary.com (/etc/httpd/conf/httpd.conf:1021)

        port 80 namevhost secondary.com (/etc/httpd/conf/httpd.conf:1030)

        port 80 namevhost dev.primary.com (/etc/httpd/conf/httpd.conf:1069)

        port 80 namevhost prod.primary.com (/etc/httpd/conf/httpd.conf:1081)

Syntax OK

I subbed out the actual IP with <primaryIP>

kaoticsnow

04-06-2010 12:41 PM

Also I have to add the 2nd SSL vhost is not configured since apache will not even start with it configured, thats why you only see the primary in the above output.

bathory

04-06-2010 01:04 PM

Quote:

*:443 is a NameVirtualHost

This is not what you want.
You want an IP-based vhost.
Remove the

Code:

NameVirtualHost *.443

and use the code for ip-based vhosts as in your previous posts.
Also better replace

Quote:

with

Code:

<VirtualHost x.x.x.1:443>

kaoticsnow

04-07-2010 08:41 PM

Still not getting the server to start with the 2nd ssl,

I did not create the ssl certs, the web developer did, I killed the server, added configuration for the secondary domain and fired the server up, I got the following printed to the error_log, this seams to me like and issue with the keys... am I correct in assuming this?

Code:

[Wed Apr 07 18:36:53 2010] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

[Wed Apr 07 18:36:53 2010] [warn] RSA server certificate CommonName (CN) `www.secondary.com' does NOT match server name!?

[Wed Apr 07 18:36:53 2010] [error] Unable to configure RSA server private key

[Wed Apr 07 18:36:53 2010] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

bathory

04-08-2010 12:33 AM

Yup, that means that the vhost2 certificate and key do not match.
You can run

Code:

openssl x509 -noout -text -in /etc/pki/tls/certs/secondary.com.crt -modulus

openssl rsa -noout -text -in /etc/pki/tls/certs/secondary.key -modulus

and compare the 2 modulus parts.

I guess this is a self-signed certificate, so you can create a new one, using the server key.
If you do so, make sure also that the CN used matches the vhost2 ServerName, so you don't get the warning about

Quote:

[Wed Apr 07 18:36:53 2010] [warn] RSA server certificate CommonName (CN) `www.secondary.com' does NOT match server name!?

kaoticsnow

04-08-2010 11:52 PM

Thanks for the help! I figured out the problem, it was the last line of the below segment, that SSLEngine was uncommented, when the default template had the SSLEngine set to on it needed a default cert. once I turned that off I was able to comment out the cert the web developer added in the head of the ssl.conf file and specify the 2nd vhost for ssl in httpd.conf. =)

Code:

<VirtualHost _default_:443>



# General setup for the virtual host, inherited from global configuration

#DocumentRoot "/var/www/html"

#ServerName www.example.com:443



# Use separate log files for the SSL virtual host; note that LogLevel

# is not inherited from httpd.conf.

ErrorLog logs/ssl_error_log

TransferLog logs/ssl_access_log

LogLevel warn



#  SSL Engine Switch:

#  Enable/Disable SSL for this virtual host.

#  SSLEngine on

All times are GMT -5. The time now is 04:32 AM.