1

I'm installing a SSL certificate to serve HTTPS. I'm using Apache 2.4 in Amazon Linux and got the certificate in Startssl. My Vhost config is the following:

<IfModule mod_ssl.c>
  <VirtualHost _default_:443>
    ServerAdmin webmaster@myweb.com
    ServerName myweb.com
    DocumentRoot /var/www/html/myapp
    <Directory /var/www/htmlmyapp>
      Options Indexes FollowSymLinks MultiViews
      AllowOverride None
      Order allow,deny
      allow from all
    </Directory>

    ErrorLog /var/log/httpd/error_log
    LogLevel warn

    CustomLog /var/log/httpd/ssl_access.log combined
    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/mycert.crt
    SSLCertificateKeyFile /etc/ssl/private/mycert.key
    SSLCertificateFile /etc/ssl/certs/sub.class1.server.ca.pem
    BrowserMatch "MSIE [2-6]" \
      nokeepalive ssl-unclean-shutdown \
      downgrade-1.0 force-response-1.
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

  </VirtualHost>
</IfModule>

When I restart Apache, I get this output:

Stopping httpd:                                            [  OK  ]
Starting httpd: Apache/2.4.12 mod_ssl (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Private key myweb.com:443:0 (/etc/ssl/private/mycert.key)
Enter pass phrase:

OK: Pass Phrase Dialog successful.
Apache:mod_ssl:Error: Private key not found.
**Stopped
                                                           [FAILED]

So, it asks me for the passphrase of a key, the passphrase is ok and then it says that it can't find it. What am I missing?

davids
  • 167
  • 2
  • 4
  • 10

2 Answers2

5

In your config, you have these three lines:

SSLCertificateFile    /etc/ssl/certs/mycert.crt
SSLCertificateKeyFile /etc/ssl/private/mycert.key
SSLCertificateFile /etc/ssl/certs/sub.class1.server.ca.pem

You are repeating SSLCertificateFile. That means that Apache will use the second instance of the variable, i.e. /etc/ssl/certs/sub.class1.server.ca.pem - but your key is the one for /etc/ssl/certs/mycert.crt, so it doesn't match the CA cert. Thus, Apache isn't able to find the key for the certificate.

Probably your config should instead look like this:

# Server certificate
SSLCertificateFile    /etc/ssl/certs/mycert.crt
# Key to server certificate
SSLCertificateKeyFile /etc/ssl/private/mycert.key
# Glue certificate to CA
SSLCACertificateFile /etc/ssl/certs/sub.class1.server.ca.pem

Note that the second certificate starts with SSLCA instead of just SSL.

Jenny D
  • 27,780
  • 21
  • 75
  • 114
  • 2
    That did it. Actually, I was using the `SSLCertificateChainFile` before, but Apache complained and told me to use `SSLCertificateFile` (`The SSLCertificateChainFile directive (/etc/httpd/conf.d/ssl.conf:22) is deprecated, SSLCertificateFile should be used instead`). Thank you! – davids Apr 16 '15 at 09:59
  • 1
    That was a misleading error message! – Jenny D Apr 16 '15 at 10:00
  • It was!! And an expensive one too, it made me waste a couple of hours :( – davids Apr 16 '15 at 10:13
0

In your configuration file, you point on the bad PrivateKey file SSLCertificateKeyFile /etc/ssl/private/mycert.key instead of SSLCertificateKeyFile /etc/ssl/private/myweb.key.

Out of the scope of the question : are you sure you want to keep a password on your private key ? Means that if your server restarts, it will need the password again. But also means that anybody that have access to the server may compromise your private key.

To generate a new key without passphrase, use : openssl rsa -in oldkey.pem -out newkey.pem

Eric Ly
  • 373
  • 2
  • 13