Answer the question
In order to leave comments, you need to log in
Why doesn't SSL certificate work on Apache2?
Good afternoon. The following situation has arisen: the SSL certificate does not work on my Apache2 web server. I received 4 files: the certificate itself for the domain, key, intermediate and root. I uploaded it to the server, sorted it into folders, connected mod_ssl to Apache, configured all paths to folders and files in "default-ssl.conf". I restart Apache, I get nothing but errors. FireFox gives "SSL_ERROR_RX_RECORD_TOO_LONG", Chrome gives "ERR_SSL_PROTOCOL_ERROR". The config itself. Where did I go wrong or did something wrong?
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin [email protected]
DocumentRoot /var/www/html
#LogLevel info ssl:warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
#Include conf-available/serve-cgi-bin.conf
SSLEngine on
SSLCertificateFile /etc/ssl/certs/domain.crt
SSLCertificateKeyFile /etc/ssl/private/private.key
SSLCertificateChainFile /etc/ssl/certs/int.crt
SSLCACertificatePath /etc/ssl/certs/
SSLCACertificateFile /etc/ssl/certs/root.crt
#SSLVerifyClient require
#SSLVerifyDepth 10
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
</VirtualHost>
</IfModule>
Answer the question
In order to leave comments, you need to log in
My version.
Instead of SSLCertificateChainFile, my root and intermediate certificates are in the same /etc/ssl/certs/star_domain_ua.ca-bundle file.
In what form do you have certificates? Did you convert them or just change the extension?
What will the command
openssl x509 -in /etc/ssl/certs/wildcard-dv-domain-ua.cer -text -noout | grep -A1 'X509v3 Key Usage'
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
SSLEngine on
SSLCertificateFile /etc/ssl/certs/wildcard-dv-domain-ua.cer
SSLCertificateKeyFile /etc/ssl/private/wildcard-dv-domain-ua-private.key
SSLCACertificateFile /etc/ssl/certs/star_domain_ua.ca-bundle
SSLProtocol -ALL -SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLHonorCipherOrder on
SSLHonorCipherOrder on
SSLStrictSNIVHostCheck Off
SSLCompression off
SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question