SSL certificate paths in a virtual host

Question

I've recently purchased a wildcard SSL certificate for my domain, generated the CSR, and everything has been sent through OK.

My question is quite straightforward, but following this - http://www.globalsign.com/support/install/install_apache.php, I can't make any sense of what to match to what.

Basically - I have 5 files:

 - gs_intermediate_ca.crt - gs_root.pem - mydomain.com.crt - intermediate.pem - *.mydomain.com.key 

The Values:

 SSLCACertificateFile = ? SSLCertificateChainFile = ? SSLCertificateFile = mydomain.com.crt SSLCertificateKeyFile = ? 

I'm new to this, any help would be greatly appreciated! Thanks

Edit >> Using the Answers below! Cheers,

I'm now receiving the following errors:

 [error] Init: Unable to read server certificate from file /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error 

My vHost now looks like so:

 SSLCertificateFile /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt SSLCertificateKeyFile /etc/apache2/domain.ssl/domain.ssl.key/domain.com.key SSLCertificateChainFile /etc/apache2/domain.ssl/ca.crt SSLCACertificateFile /etc/apache2/domain.ssl/gs_intermediate_ca.crt 

Any idea where these errors can be coming from - is there a check I can run on the .crt file?

Kind regards

Answer 1

That doc is definitely confusing. My guess:

SSLCACertificateFile = /path/to/gs_intermediate_ca.crt SSLCertificateChainFile = /path/to/chain_file SSLCertificateFile = /path/to/mydomain.com.crt SSLCertificateKeyFile = /path/to/mydomain.com.wildcard.key 

You should put all files outside the DocumentRoot and protect them with ownership/permissions. (I usually store certs in /etc/apache2/ssl and set ownership to root:root, permissions to 400.)

EDIT: You should download a combined chain ("bundle") file here: http://www.globalsign.com/support/intermediate-root-install.php

Scroll to GlobalSign Root Bundle Certificates.

Answer 2

SSLCertificateFile mydomain.com.crt SSLCertificateKeyFile mydomain.com.key 

For SSLCertificateChainFile, you'll make a new file. Combine the intermediate and root certificates into one file formatted like this:

-----BEGIN CERTIFICATE----- (intermediate certificate's base64 data here) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (root certificate's base64 data here) -----END CERTIFICATE----- 

And point SSLCertificateChainFile at that.