Topic: Help troubleshooting Apache config/SSL certificates

[julifos]

Apache 2.4.29, Ubuntu 18.04
Hi!
I'm trying to setup different domains in the same config file and everything works fine till the last domain (called domain3 in this example):

[mraddi]

Good evening,

[julifos]

Thanks for your answer.

This is the output without SSLEngine On:

[tangent]

Since the virtual host definitions are similar (apart from the certificates of course), it rather suggests your problem lies with the certificate files/chain.

My suggestions for domain3 would be to:

a) Check the ownership and permissions on the certificate files (presuming the key file is read only to the Apache process owner).

b) Temporarily, try using domain2 certificates for domain3, to see if Apache still starts. If so, you know there's a problem with the domain3 certs.

c) Is there a password assigned to the domain3 private key file, preventing Apache from starting? Check the start of the key file for the word encrypted, e.g.


Code:

$ head -3 private-key.pem -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-256-CBC,C0A142839C75245013ABCADBA500BB8E


If there is a password on the private key then create a new private key file without one.


Code:

$ openssl rsa -in old-key.pem -out new-key.pem


d) Check your certificate and private key match using the openssl modulus command, e.g. compare the hash outputs from:


Code:

$ openssl x509 –noout –modulus –in site-cert.pem  | openssl sha256 $ openssl rsa –noout –modulus –in site-key.pem | openssl sha256


e) Enable SSL debug in the configuration, and restart Apache. The error log file should contain helpful information over what the problem is.


Code:

LogLevel info ssl:debug


At this point my guess would be there's a problem with the certificate chain, which you'd need to resolve. There are any number of links on the net showing how to use the openssl verify option to do this, but you'll probably need to split the CA and Intermediate certificates into separate files to check, e.g.


Code:

$ openssl verify -CAfile root-ca-cert.pem -untrusted intermediate-cert.pem site-cert.pem

Let us know how you get on.

[julifos]

Tx!

a) Ownership and permissions are the same both for domain2 and domain3.
b) Yes, using domain2 certificates for domain3 lets Apache start, so some kind of issue exists with the certificates of domain3...
c) No encryption.
d) Match!
e) From different error-log files:

[tangent]

I'm somewhat confused, since if the modulus for the key and certificate match, they should be ok. You should be able to check the modulus for the corresponding CSR, which should also be the same (use "openssl req –noout –modulus ...")

Are the domain3 files all clean, PEM layout, no missing final EOL character, no mixed LF / CRLF problems?

Key problem aside though, I'd still verify the CA, Intermediate and site cert files, to make sure the certificate chain is valid, and confirm your CA hasn't provided an incorrect/expired Intermediate.

You can't re-create a key for existing certificates. If things really are still broken, you'll have to speak nicely to your CA and see if you can start again with a new key file and CSR.