You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Kirthi Narayan <ki...@gmail.com> on 2007/06/11 21:42:30 UTC
[users@httpd] Apache ssl certs
Hi All,
I have some issues with ssl certs, i am generating the certs with the
following commands and putting the certs file in apache conf directory.
When i browse for https i get certification error. Could any one guide me on
this.
./openssl req -new > new.cert.csr
./openssl rsa -in privkey.pem -out new.cert.key
./openssl x509 -in new.cert.csr -out new.cert.cert \
-req -signkey new.cert.key -days 999
cp new.cert.key /usr/local/apache/conf/server.key
cp new.cert.cert /usr/local/apache/conf/server.crt
Thanks in advance.
Kirthi
Re: [users@httpd] Apache ssl certs
Posted by Joshua Slive <jo...@slive.ca>.
On 6/11/07, Sander Temme <sc...@apache.org> wrote:
>
> On Jun 11, 2007, at 12:42 PM, Kirthi Narayan wrote:
>
> > When i browse for https i get certification error. Could any one
> > guide me on this.
> >
> > ./openssl rsa -in privkey.pem -out new.cert.key
> > ./openssl x509 -in new.cert.csr -out new.cert.cert \
> > -req -signkey new.cert.key -days 999
>
> When you say 'certification error' do you mean that your browser does
> not recognize the entity that signed the certificate? That is to be
> expected since you generated a self-signed certificate. Unless you
> install the certificate in your browser (Accept Permanently or
> whatever the equivalent is for your browser), you'll get this every
> time and it is essentially harmless.
[Harmless for testing or for use with a single trusted client. Almost
completely insecure for general Internet use.]
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache ssl certs
Posted by Sander Temme <sc...@apache.org>.
On Jun 11, 2007, at 12:42 PM, Kirthi Narayan wrote:
> When i browse for https i get certification error. Could any one
> guide me on this.
>
> ./openssl rsa -in privkey.pem -out new.cert.key
> ./openssl x509 -in new.cert.csr -out new.cert.cert \
> -req -signkey new.cert.key -days 999
When you say 'certification error' do you mean that your browser does
not recognize the entity that signed the certificate? That is to be
expected since you generated a self-signed certificate. Unless you
install the certificate in your browser (Accept Permanently or
whatever the equivalent is for your browser), you'll get this every
time and it is essentially harmless.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
Re: [users@httpd] Apache ssl certs
Posted by Kirthi Narayan <ki...@gmail.com>.
And also in the logs i find
[Tue Jun 12 01:53:14 2007] [notice] Digest: generating secret for digest
authentication ...
[Tue Jun 12 01:53:14 2007] [notice] Digest: done
[Tue Jun 12 01:53:15 2007] [notice] Apache/2.2.4 (Unix) mod_ssl/2.2.4
OpenSSL/0.9.8e DAV/2 configured -- resuming normal operations
is there any mistake i have done in compilng apache?
Thanks
Kirthi
On 6/12/07, Graeme Fowler <gr...@graemef.net> wrote:
>
> On Tue, 2007-06-12 at 01:12 +0530, Kirthi Narayan wrote:
> > Hi All,
> >
> > I have some issues with ssl certs, i am generating the certs with the
> > following commands and putting the certs file in apache conf
> > directory.
> >
> > When i browse for https i get certification error. Could any one guide
> > me on this.
>
> What errors do you get?
>
> Graeme
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
RE: [users@httpd] Apache ssl certs
Posted by "Salcedo, Simon" <Si...@patriarchdirect.com>.
Is your main site called "testhp.com" or "www.testhp.com"? Since your
certificate is for "testhp.com", your ServerName should be "testhp.com"
Regards,
Simon
________________________________
From: Kirthi Narayan [mailto:kirthiks@gmail.com]
Sent: Monday, June 11, 2007 3:38 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache ssl certs
________________________________
Re: [users@httpd] Apache ssl certs
Posted by Kirthi Narayan <ki...@gmail.com>.
It is for a testing purpose, and the domain name is testhp.com that i
provide during the certifcate generation.
Kirthi
On 6/12/07, Salcedo, Simon <Si...@patriarchdirect.com> wrote:
>
> Ok. But I also need to know what domain name you sent to your
> certificate provider, as this is likely included in the certificate.
>
>
>
> Regards,
>
>
>
> Simon
> ------------------------------
>
> *From:* Kirthi Narayan [mailto:kirthiks@gmail.com]
> *Sent:* Monday, June 11, 2007 3:26 PM
> *To:* users@httpd.apache.org
> *Subject:* Re: [users@httpd] Apache ssl certs
>
>
> ------------------------------
>
RE: [users@httpd] Apache ssl certs
Posted by "Salcedo, Simon" <Si...@patriarchdirect.com>.
Ok. But I also need to know what domain name you sent to your
certificate provider, as this is likely included in the certificate.
Regards,
Simon
________________________________
From: Kirthi Narayan [mailto:kirthiks@gmail.com]
Sent: Monday, June 11, 2007 3:26 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache ssl certs
________________________________
Re: [users@httpd] Apache ssl certs
Posted by Kirthi Narayan <ki...@gmail.com>.
Hi,
I just checkd it is the server name that i have given, Could i fwd you the
httpd.conf file so that you could have a look at the file.
Kirthi
On 6/12/07, Salcedo, Simon <Si...@patriarchdirect.com> wrote:
>
> Kirthi,
>
>
>
> When the certs were generated, the domain name was used. In your .conf,
> the ServerName entry is probably your IP address.
>
>
>
> Regards,
>
>
>
> Simon
> ------------------------------
>
> *From:* Kirthi Narayan [mailto:kirthiks@gmail.com]
> *Sent:* Monday, June 11, 2007 3:12 PM
> *To:* users@httpd.apache.org
> *Subject:* Re: [users@httpd] Apache ssl certs
>
>
>
>
>
>
>
> This is the following error i am getting, i have given the cn name as the
> same system hostname.
>
>
>
> MIsmatched address
>
> The security certificate issued was issued for a different website address
>
> the probelm maybe indicate to fool you or intercept any data you send to
> the server.
>
> We recommand you to close the web browser
>
>
>
> On 6/12/07, *Graeme Fowler* <gr...@graemef.net> wrote:
>
> On Tue, 2007-06-12 at 01:12 +0530, Kirthi Narayan wrote:
> > Hi All,
> >
> > I have some issues with ssl certs, i am generating the certs with the
> > following commands and putting the certs file in apache conf
> > directory.
> >
> > When i browse for https i get certification error. Could any one guide
> > me on this.
>
> What errors do you get?
>
> Graeme
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL: http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
Re: [users@httpd] Apache ssl certs
Posted by Krist van Besien <kr...@gmail.com>.
On 6/11/07, Kirthi Narayan <ki...@gmail.com> wrote:
> Hi Sander,
>
> Thanks for the mail, I am totally using for testing purpose in the lab
> envirnoment. Is there a possiblity to fix this issue, i wanted to access
> this box via IP as well as hostname. Please let me know.
You can't access a ssl box both via IP and hostname without such
errors. As the other posters already pointed out: The hostname is you
type it in your browser's adress bar must be identical to what you
used as common name in your certificate.
Krist
--
krist.vanbesien@gmail.com
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache ssl certs
Posted by Kirthi Narayan <ki...@gmail.com>.
Hi Sander,
Thanks for the mail, I am totally using for testing purpose in the lab
envirnoment. Is there a possiblity to fix this issue, i wanted to access
this box via IP as well as hostname. Please let me know.
thanks
Kirthi
On 6/12/07, Sander Temme <sc...@apache.org> wrote:
>
>
> On Jun 11, 2007, at 1:12 PM, Kirthi Narayan wrote:
>
> >
> >
> > This is the following error i am getting, i have given the cn name
> > as the same system hostname.
> >
> > MIsmatched address
> > The security certificate issued was issued for a different website
> > address
> >
> > the probelm maybe indicate to fool you or intercept any data you
> > send to the server.
> >
> > We recommand you to close the web browser
>
> When your browser makes an SSL connection, it checks the Common Name
> field of the Distinguished Name string in the certificate and
> compares that against the hostname you typed into the browser
> location bar. If those two don't match, you get that error message.
>
> For instance, if you gave a hostname when your openssl req call asked
> for Common Name information, but you're accessing your server by IP
> address the browser will conclude that the two don't match.
>
> Again totally harmless in a testing situation, but as Joshua reminds
> us would greatly diminish the trust your users could be expected to
> place in your production server. I recommend that you have your
> hostname setup sorted out before you pay money for a certificate.
>
> S.
>
> --
> Sander Temme
> sctemme@apache.org
> PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
>
>
>
>
>
Re: [users@httpd] Apache ssl certs
Posted by Sander Temme <sc...@apache.org>.
On Jun 11, 2007, at 1:12 PM, Kirthi Narayan wrote:
>
>
> This is the following error i am getting, i have given the cn name
> as the same system hostname.
>
> MIsmatched address
> The security certificate issued was issued for a different website
> address
>
> the probelm maybe indicate to fool you or intercept any data you
> send to the server.
>
> We recommand you to close the web browser
When your browser makes an SSL connection, it checks the Common Name
field of the Distinguished Name string in the certificate and
compares that against the hostname you typed into the browser
location bar. If those two don't match, you get that error message.
For instance, if you gave a hostname when your openssl req call asked
for Common Name information, but you're accessing your server by IP
address the browser will conclude that the two don't match.
Again totally harmless in a testing situation, but as Joshua reminds
us would greatly diminish the trust your users could be expected to
place in your production server. I recommend that you have your
hostname setup sorted out before you pay money for a certificate.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
RE: [users@httpd] Apache ssl certs
Posted by "Salcedo, Simon" <Si...@patriarchdirect.com>.
Kirthi,
When the certs were generated, the domain name was used. In your .conf,
the ServerName entry is probably your IP address.
Regards,
Simon
________________________________
From: Kirthi Narayan [mailto:kirthiks@gmail.com]
Sent: Monday, June 11, 2007 3:12 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Apache ssl certs
This is the following error i am getting, i have given the cn name as
the same system hostname.
MIsmatched address
The security certificate issued was issued for a different website
address
the probelm maybe indicate to fool you or intercept any data you send to
the server.
We recommand you to close the web browser
On 6/12/07, Graeme Fowler <gr...@graemef.net> wrote:
On Tue, 2007-06-12 at 01:12 +0530, Kirthi Narayan wrote:
> Hi All,
>
> I have some issues with ssl certs, i am generating the certs with the
> following commands and putting the certs file in apache conf
> directory.
>
> When i browse for https i get certification error. Could any one guide
> me on this.
What errors do you get?
Graeme
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server
Project.
See <URL: http://httpd.apache.org/userslist.html
<http://httpd.apache.org/userslist.html> > for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache ssl certs
Posted by Kirthi Narayan <ki...@gmail.com>.
This is the following error i am getting, i have given the cn name as the
same system hostname.
MIsmatched address
The security certificate issued was issued for a different website address
the probelm maybe indicate to fool you or intercept any data you send to the
server.
We recommand you to close the web browser
On 6/12/07, Graeme Fowler <gr...@graemef.net> wrote:
>
> On Tue, 2007-06-12 at 01:12 +0530, Kirthi Narayan wrote:
> > Hi All,
> >
> > I have some issues with ssl certs, i am generating the certs with the
> > following commands and putting the certs file in apache conf
> > directory.
> >
> > When i browse for https i get certification error. Could any one guide
> > me on this.
>
> What errors do you get?
>
> Graeme
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] Apache ssl certs
Posted by Graeme Fowler <gr...@graemef.net>.
On Tue, 2007-06-12 at 01:12 +0530, Kirthi Narayan wrote:
> Hi All,
>
> I have some issues with ssl certs, i am generating the certs with the
> following commands and putting the certs file in apache conf
> directory.
>
> When i browse for https i get certification error. Could any one guide
> me on this.
What errors do you get?
Graeme
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org