Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm setting up SSL for the first time.

I edited my config files in sites-enabled and ran apache2ctl configtest. Got back Syntax OK.

I then ran apache2ctl graceful. There weren't any errors or anything, and I was returned to the prompt. However the site was down after running this, so I quickly put back the old config files and restarted.

If my syntax was okay, why didn't Apache restart? Do I need to do apache2ctl stop/ apache2ctl start instead of the graceful command? Will I be asked to enter the passphrase for my key file?

Configuration changes made:

  • Changed NameVirtualHost * to NameVirtualHost *:80 and added line for NameVirtualHost *:443

  • Changed all VirtualHost * lines to VirtualHost *:80

  • Added VirtualHost section for the site that I want to have SSL available and made that section VirtualHost *:443

  • Added these lines to the new VirtualHost:

    SSLEngine On
    SSLCertificateFile pathtocert
    SSLCertificateKeyFile pathtokey
    SSLCertificateChainFile pathtochainfile
    

UPDATE 8th July: After checking additional log files I finally found a smoking gun:

SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

So at least something else to go on.


share|improve this question
    
Note that "NameVirtualHost *:443" is deceptive. That doesn't ACTUALLY work. It seems to, but it doesn't. The hostname is encrypted with the HTTP traffic, so Apache can't know what ssl certs to apply to correct decrypt virtual host traffic on a single IP over ssl. As for your specific problem, I dunno, I've had this before, solved it by reading docs, don't recall a particularly helpful suggestion. –  Doc Jul 7 '11 at 20:53
    
@ThouArtNotDoc: What you're saying was correct several years ago, but nowadays major web browsers support TLS SNI allowing to use virtual hosts over SSL. –  grawity Jul 7 '11 at 21:14
    
@grawity - sadly, we still get some traffic on IE6. I know.. I know.. It should be punished by mandatory rides through a woodchipper.. Anyway, thanks for pointing that out.. I recently learned about Google Chrome Frame, which may be a good enough fix for me to finally adopt TLS SNI. Much thanks. –  Doc Jul 7 '11 at 21:37
    
@ThouArtNotDoc: You could point users to BrowseHappy or this official MS page... not that it would help much. –  grawity Jul 7 '11 at 21:59

1 Answer 1

Ok, found the answer. All my fault.

Turns out I had created a key file a few months ago and never used it. But then mistakenly copied that one to be used by the web server. So basically had the wrong file. Dumb dumb.

Also missed the original error (see my Update above) in one of my log files which would have put me on the right track to begin with.

Server is up now and ssl is working.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.