Hi Folks,

I tried to install a SSL cert on my linode and ran into some problems, I'm not sure exactly how to resolve them...

At this point I have created a folder /etc/ssl/localcerts where I have the following files:

3x CRT files
1x bundle of the above files using CAT
1x myserver.key
1x mydomain_com.crt

I followed this guide:

https://www.linode.com/docs/websites/ss ... ertificate
then did this:
https://www.linode.com/docs/security/ss ... ian-ubuntu

I edited one virtual host file (there were two in sites available) to include the lines in the second guide. The other file was 000-default and seemed to have no mention of SSL so I didn't do anything to it...

I feel like i'm really 'almost there' but have perhaps missed a step or two? If anyone might know of a solution that would be great. The URL is guidewealthmanagement.com

Apache needs the "Bundle" file added to the mydomain_com.crt (cat bundle.crt >> mydomain_com.crt), and referenced for the SSLCertificateFile directive, the myserver.key is then referenced in the SSLCertificateKeyFile directive.

If you have multiple hosts on your system, realistically you'll want to define these in a <VirtualHost *:443> block that has a line referencing the servername.

Realistically your config is going to loosely look something like this (using the guide as a rough reference)

<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/mydomain_com.crt
    SSLCertificateKeyFile /etc/ssl/localcerts/myserver.key

    ServerAdmin someemail@guidewealthmanagement.com
    ServerName guidewealthmanagement.com
    ServerAlias http://www.guidewealthmanagement.com

    DocumentRoot /path/to/vhost/public_html
    ErrorLog /path/to/vhost/error.log
    CustomLog /path/to/vhost/access.log combined
</VirtualHost>

Thanks very much for the reply - I tried what you mentioned, but it didn't immediately work, so I reversed the bundling and kept the files separate again. The guide on Comodo offers the following:

SSLEngine on
SSLCertificateKeyFile /etc/ssl/ssl.key/server.key
SSLCertificateFile /etc/ssl/ssl.crt/yourDomainName.crt
SSLCertificateChainFile /etc/ssl/ssl.crt/yourDomainName.ca-bundle

Which is what I have done.. the only difference is that I have:

etc/ssl/localcerts/

Also, my file is pretty long, it has a lot of commented out information, so I wonder if within that there may be some conflicting commands - is this something that you would delete and keep to the minimum commands outlined above? Here's the content now:

<IfModule mod_ssl.c>
        <VirtualHost _default_:443>
                ServerAdmin webmaster@localhost

                DocumentRoot /var/www/html

                # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                # error, crit, alert, emerg.
                # It is also possible to configure the loglevel for particular
                # modules, e.g.
                #LogLevel info ssl:warn

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                # For most configuration files from conf-available/, which are
                # enabled or disabled at a global level, it is possible to
                # include a line for only one particular virtual host. For example the
                # following line enables the CGI configuration for this host only
                # after it has been globally disabled with "a2disconf".
                #Include conf-available/serve-cgi-bin.conf

                #   SSL Engine Switch:
                #   Enable/Disable SSL for this virtual host.
                SSLEngine on
    SSLCertificateFile /etc/ssl/localcerts/guidewealthmanagement_com.crt
    SSLCertificateKeyFile /etc/ssl/localcerts/myserver.key
    SSLCertificateChainFile /etc/ssl/localcerts/guide.ca-bundle

    ServerAdmin matt@guidewealthmanagement.com
    ServerName guidewealthmanagement.com
    ServerAlias http://www.guidewealthmanagement.com
    DocumentRoot /var/www/html/
    ErrorLog /var/www/log/error.log
    CustomLog /var/www/log/access.log combined

It continues as follows:

#   A self-signed (snakeoil) certificate can be created by installing
                #   the ssl-cert package. See
                #   /usr/share/doc/apache2/README.Debian.gz for more info.
                #   If both key and certificate are stored in the same file, only the
                #   SSLCertificateFile directive is needed.
                SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
                SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

                #   Server Certificate Chain:
                #   Point SSLCertificateChainFile at a file containing the
                #   concatenation of PEM encoded CA certificates which form the
                #   certificate chain for the server certificate. Alternatively
                #   the referenced file can be the same as SSLCertificateFile
                #   when the CA certificates are directly appended to the server
                #   certificate for convinience.
                #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

                #   Certificate Authority (CA):
                #   Set the CA certificate verification path where to find CA
                #   certificates for client authentication or alternatively one
                #   huge file containing all of them (file must be PEM encoded)
                #   Note: Inside SSLCACertificatePath you need hash symlinks
                #                to point to the certificate files. Use the provided
                #                Makefile to update the hash symlinks after changes.
                #SSLCACertificatePath /etc/ssl/certs/
                #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

                #   Certificate Revocation Lists (CRL):
                #   Set the CA revocation path where to find CA CRLs for client
                #   authentication or alternatively one huge file containing all
                #   of them (file must be PEM encoded)
                #   Note: Inside SSLCARevocationPath you need hash symlinks
                #                to point to the certificate files. Use the provided
                #                Makefile to update the hash symlinks after changes.
                #SSLCARevocationPath /etc/apache2/ssl.crl/
                #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
#   Client Authentication (Type):
                #   Client certificate verification type and depth.  Types are
                #   none, optional, require and optional_no_ca.  Depth is a
                #   number which specifies how deeply to verify the certificate
                #   issuer chain before deciding the certificate is not valid.
                #SSLVerifyClient require
                #SSLVerifyDepth  10

                #   SSL Engine Options:
                #   Set various options for the SSL engine.
                #   o FakeBasicAuth:
                #        Translate the client X.509 into a Basic Authorisation.  This means that
                #        the standard Auth/DBMAuth methods can be used for access control.  The
                #        user name is the `one line' version of the client's X.509 certificate.
                #        Note that no password is obtained from the user. Every entry in the user
                #        file needs this password: `xxj31ZMTZzkVA'.
                #   o ExportCertData:
                #        This exports two additional environment variables: SSL_CLIENT_CERT and
                #        SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
                #        server (always existing) and the client (only existing when client
                #        authentication is used). This can be used to import the certificates
                #        into CGI scripts.
                #   o StdEnvVars:
                #        This exports the standard SSL/TLS related `SSL_*' environment variables.
                #        Per default this exportation is switched off for performance reasons,
                #        because the extraction step is an expensive operation and is usually
                #        useless for serving static content. So one usually enables the
                #        exportation for CGI and SSI requests only.
#   o OptRenegotiate:
                #        This enables optimized SSL connection renegotiation handling when SSL
                #        directives are used in per-directory context.
                #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

                #   SSL Protocol Adjustments:
                #   The safe and default but still SSL/TLS standard compliant shutdown
                #   approach is that mod_ssl sends the close notify alert but doesn't wait for
                #   the close notify alert from client. When you need a different shutdown
                #   approach you can use one of the following variables:
                #   o ssl-unclean-shutdown:
                #        This forces an unclean shutdown when the connection is closed, i.e. no
                #        SSL close notify alert is send or allowed to received.  This violates
                #        the SSL/TLS standard but is needed for some brain-dead browsers. Use
                #        this when you receive I/O errors because of the standard approach where
                #        mod_ssl sends the close notify alert.
                #   o ssl-accurate-shutdown:
 This forces an accurate shutdown when the connection is closed, i.e. a
                #        SSL close notify alert is send and mod_ssl waits for the close notify
                #        alert of the client. This is 100% SSL/TLS standard compliant, but in
                #        practice often causes hanging connections with brain-dead browsers. Use
                #        this only for browsers where you know that their SSL implementation
                #        works correctly.
                #   Notice: Most problems of broken clients are also related to the HTTP
                #   keep-alive facility, so you usually additionally want to disable
                #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
                #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
                #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
                #   "force-response-1.0" for this.
                BrowserMatch "MSIE [2-6]" \
                                nokeepalive ssl-unclean-shutdown \
                                downgrade-1.0 force-response-1.0
                # MSIE 7 and newer should be able to use keepalive
                BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

        </VirtualHost>
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

I'm wondering if some of that code may be an issue? For example the 'snakeoil' path?

Is it advised to delete all this and keep the file to the bare number of lines discussed earlier, or create a new file with those only or something else?

Comment out these, and any other directives you are replacing with your own that are not commented out.
There should only be 1 uncommented directive of each type.

                SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
                SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

Thank you for this.

Since writing, I had tried something else, I have pulled out the code I added and created a third config file with just that in it, so I now have:

000-default
ssl-default
guidewealtmanagement.conf

The last I have the SSL key path directives in it.

I then went back in as you say to disable the Snakeoil certs, but still no dice....

Could it be that I need to tell Apache to look at the third .conf file somewhere?

You just have to mention it only on the virtual config of that particular domain

SSLEngine on
SSLCertificateFile /location/pache.crt
SSLCertificateKeyFile /location/apache.key
SSLCertificateChainFile /location/yourDomainName.ca-bundle


Also make sure you have proper crt and key, you can test it using some Certificate Key Matcher

_________________
Server Management with 24x7 monitoring
http://iserversupport.com/on-demand/