Question:
I’m having hard time trying to setup an SSL certificate (it’s a Comodo PositiveSSL purshased from NameCheap) on my EC2 micro instance (I’m using Amazon Linux AMI 2012.3, which is based on CentOS if I’m not mistaken).
Here’s what I did:
- I installed mod_ssl & OpenSSL
- I enabled port 443 on my EC2’s instance security group
- I CHMODed the *.key & *.crt files to 777 as Comodo suggested
- I’m certain the IP address & files path are correct (put a bunch of
0s in the example but it is correct in my ssl.conf) - I added this VirtualHost entry to ssl.conf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
############# I tried both with & without this section ############## ServerName www.mydomain.com:443 ServerAlias www.mydomain.com DocumentRoot /var/www ServerAdmin webmaster@mydomain.com ###################################################################### SSLEngine on SSLCertificateKeyFile /etc/ssl/mydomain_com.key SSLCertificateFile /etc/ssl/mydomain_com.crt SSLCertificateChainFile /etc/ssl/mydomain_com.ca-bundle |
Then I restarted apache…but I stil cannot access https://www.mydomain.com/ !!!
I checked with ssltool.com, it says
1 2 3 4 5 6 |
The Common Name on the certificate is: ip-00-00-00-000 The certificate chain consists of: SomeOrganization, ip-00-00-00-000. Expires on: Apr 10 13:39:41 2013 GMT - that's 363 days from today. The site tested mydomain.com is NOT the same as the Subject CN ip-00-00-00-000!. |
I even went & copied the VistualHost to httpd.conf instead of ssl.conf & restarted apache, all in vain.
I’ve been banging my head against the wall for days now. I’m pretty sure I’m missing a tiny something to make this work, I just don’t know what exactly.
I’d be infinitely grateful if someone can suggest something to make this work!
Answer:
Sometimes this section
1 2 |
prevents your real SSL certificate from being used. If this is the case either comment VirtualHost default or move the SSLCertificate* attributes to it, ie.
1 2 3 4 5 6 |
SSLCertificateKeyFile /etc/ssl/mydomain_com.key SSLCertificateFile /etc/ssl/mydomain_com.crt SSLCertificateChainFile /etc/ssl/mydomain_com.ca-bundle |
Make sure you restart apache after that.