I Get An Error

bossman759@ubuntu:~$ sudo service apache2 reload Syntax error on line 173 of /etc/apache2/sites-enabled/default-ssl: SSLCertificateKeyFile: file ‘/etc/apache2/ssl/apache.ke’ does not exist or is empty Action ‘configtest’ failed. The Apache error log may have more information. …fail!

Maybe a small typo, the error lists: “/etc/apache2/ssl/apache.ke”

The tutorial is for: “/etc/apache2/ssl/apache.key”

So the key file you are pointing doesn’t exist, just looks like you missed the y on the end.

Double check the paths to make sure all of the files you are referencing are where they are supposed to be and if you still have an issue let us know.

You hava a mistake when you typed the location of your “apache.key” file. If you read the location of the error message, you can see that the file you typed was “/etc/apache2/ssl/apache.ke”

How about this?

Syntax error on line 47 of /etc/apache2/sites-enabled/default-ssl: SSLCertificateFile: file ‘/etc/apache2/ssl/apache.crt’ does not exist or is empty Action ‘configtest’ failed. The Apache error log may have more information. …fail!

The error is the file does not exist or is empty, make sure you put your Apache certificate file in place /etc/apache2/ssl/apache.crt

You can verify that its the right file by running: cat /etc/apache2/ssl/apache.crt – that will show you the contents of the certificate file.

Worked like a charm. Thanks a lot.

Thanks Worked Like a charm on Ubuntu 12.04!

Thanks! Let me know if you there are any topics you would like to see. =]

100% worked on my VPS Ubuntu 12.04.1 LTS thanks for sharing …

Great walk-through, bookmarking this. This is the most clear and concise explanation that I have found yet. THANK YOU!

How could I do it to create a self-signed certificate that can work on all subdomains? example subdomain1.example.com, subdomain2.example.com, etc

You can create an self-signed SSL certificate that will work on all domains by including a catchall in the common name.

Include an asterisk in the following line: “Common Name (e.g. server FQDN or YOUR name) []:*.example.com”

I have a doubt… In the original file where do you have to change this? SSLEngine on SSLCertificateFile /etc/apache2/ssl/apache.crt SSLCertificateKeyFile /etc/apache2/ssl/apache.key ? I can’t find them like that

btw in this part ServerName example.com:443 I used this ServerName localhost:443

You would put: SSLEngine on SSLCertificateFile /etc/apache2/ssl/apache.crt SSLCertificateKeyFile /etc/apache2/ssl/apache.key Inside of the VirtualHost where you would like that SSL to be active.

As for the ServerName, that should actually be the name of the domain you setup such as “domain.com” and inside of your VirtualHost you can specify the IP as: VirtualHost xx.xx.xx.xx:443

Then this VirtualHost will only be active for requests on port 443 which is HTTPS.

I have an error when executing the last command (sudo service apache2 reload):

• Reloading web server config apache2
  [Wed Jan 16 22:31:15 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

During the setup of the initial certificate, I didn’t use the actual “.com” name of the website, as I thought common name was just a shorthand name. I then read the bit about common name being the most important step (oops), so after I received the above error the first time, I reran the certificate setup and used the correct “.com” name but I’m still getting the same error. Any ideas? (I checked that the SSL config file with VirualHost *:443 and the other edits and they have all been saved).

That error is related to your Apache virtualhost configuration and not your SSL certificate.

It just means that you may have a Listen *:80 directive and that you have no VirtualHost *:80 configured, so while you are listening on port 80 you do not have anything configured to serve traffic which is what that refers to.

Ok, so where would I go to change the “Listen *:80” directive? I guess what I’m asking is, how do I go about fixing this? I’ve followed all the steps so far word for word…

So, I’ve found a “Listen 80” directive along with a “NameVirtualHost *:80” directive in ports.conf in /etc/apache2/. What and how do I need to edit this file (if it is this file) in order to make this work?

I’ve tried visiting the address of the site both with regular http and https and both time out…

In most cases the SSL protected website and the non-SSL website are the same so you can do one of two things:

1. Create a VirtualHost *:80 directive with the same settings as your 443 VirtualHost just remove any mention of the SSL certs so you can serve the same website from http://

2. Create a VirtualHost *:80 directive for the same site and redirect all requests via RewriteRules to the 443 SSL enabled VirtualHost.

We do not use Apache, we use nginx, but we employ method 2, so if you goto http://www.digitalocean.com you will be redirected to https://www.digitalocean.com - this way we ensure that all connections to our website are secure and encrypted.

So I searched around and instead of using rewrite rules, I decided to use a permanent redirect but I still am getting no results. Maybe posting these first few lines will shed some light on my situation:

<VirtualHost *:80> ServerName ec2-XXX.compute-1.amazonaws.com:80 Redirect permanent / ec2-XXX.compute-1.amazonaws.com:443 </VirtualHost>

<VirtualHost *:443> ServerAdmin webmaster@localhost ServerName ec2-XXX.compute-1.amazonaws.com:443

    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/apache.crt
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key

…

I restarted the apache server with these settings but there is still a network timeout whenever I try to access either the regular or secure version of the site. Any ideas? I’ll try rewrite rules, but I feel like the issue may be rooted elsewhere…

Remove the SSL lines from your VirtualHost for :80.

Then also paste your 443 config, because it will be redirecting to 443 so if the 443 config isn’t working then it wont load for either.

Sorry about the last post, it apparently doesn’t like things wrapped in HTML-style tags so it was hard to see what was actually a part of what VirtualHost (I’ll post the rest of the 443 config though).

There were/are no SSL directives/lines in my VirtualHost for :80. Here are both VirtualHosts in /etc/apache2/sites-enabled/000-default:

<VirtualHost *:80 ServerName ec2-XXX.compute-1.amazonaws.com:80 Redirect permanent / ec2-XXX.compute-1.amazonaws.com:443 </VirtualHost

<VirtualHost *:443 ServerAdmin webmaster@localhost ServerName ec2-XXX.compute-1.amazonaws.com:443

    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/apache.crt
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key

    DocumentRoot /var/www
    <Directory /
            Options FollowSymLinks
            AllowOverride None
    </Directory
    <Directory /var/www/
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    </Directory

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin"
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
            Order allow,deny
            Allow from all
    </Directory

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/"
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
    Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory

</VirtualHost

Argh - I’m going to change the HTML style brackets to {{ and }}

{{VirtualHost *:80}} ServerName ec2-XXX.compute-1.amazonaws.com:80 Redirect permanent / ec2-XXX.compute-1.amazonaws.com:443 {{/VirtualHost}}

{{VirtualHost *:443}} ServerAdmin webmaster@localhost ServerName ec2-XXX.compute-1.amazonaws.com:443

    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/apache.crt
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key

    DocumentRoot /var/www
    {{Directory /}}
            Options FollowSymLinks
            AllowOverride None
    {{/Directory}}
    {{Directory /var/www/}}
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
    {{/Directory}}

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    {{Directory "/usr/lib/cgi-bin"}}
            AllowOverride None
            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
            Order allow,deny
            Allow from all
    {{/Directory}}

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

Alias /doc/ "/usr/share/doc/"
{{Directory "/usr/share/doc/"}}
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
    Allow from 127.0.0.0/255.0.0.0 ::1/128
{{/Directory}}

{{/VirtualHost}}

When you access the 443 site directly what do you see?

And have you checked your error log ?

Lastly, you mentioned that you are getting a network timeout, so you want to also test connectivity to the webserver as well. For that just do:

telnet server.ip.address 80

telnet server.ip.address 443

That will show you if you can connect to the server’s HTTP server, if not that means you may have an issue possibly with firewall settings, or with what ports/ips HTTP is listening on.

Wow… silly me. I’m using amazon web services as the backbone of the project, and a barebones EC2 Ubuntu instance comes default with no open ports. All I had to do was edit the security settings to allow incoming connections on ports 80 and port 443.

I did have to edit the redirect code in the {{VirtualHost *:80}} tag though because simply using the port :443 without specifying the protocol (http vs https, it defaults to using http) comes back with an error saying that I was trying to access a secure port using regular http. I simply edited the redirect code like the following:

{{VirtualHost *:80}} ServerName ec2-XXX.compute-1.amazonaws.com:80 Redirect permanent / https://ec2-XXX.compute-1.amazonaws.com: {{/VirtualHost}}

Thanks for the help - apologies for the simplicity of my mistake.

Hi, it works in my server (Ubuntu12.04) but when i tried to connect with https, chrome show a warning. I allow it but in url, there is a line on https://… (it doesn’t seem trusted)

Is it work like this? How can I verify the ssl?

That warning means that your SSL certificate isn’t signed by a trusted authority like NetworkSolutions.

What this means is that the connection is secure via SSL, but visitors will get that warning, if you buy an SSL certificate from NetworkSolutions or another authority then they will provide you a new SSL cert based on your SSL key and then the warning will go away.

This is because it is a self-signed certificate and not verified by a third party.

To avoid getting that screen, you will need to install a valid, signed, SSL certificate from a provider such as StartSSL (for a free one) or Comodo (for a low-priced paid one).

Worth reading this too, only takes a few extra minutes: Hardening your Web Server’s SSL Ciphers - http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/

How do I make this work for a particular subdomain only?

Such as cart checkout with https at “https://secure.mydomain.com”

And everything else with http at “http://mydomain.com”

Many thanks!