0

My Apache server on CentOS7 suddenly stopped working after a reboot.

I had SSL configuration with .crt and .key wildcard certificates obtained from a valid CA.

When I restart the httpd service I have no errors, but the webpage is not loading.

I have verified that my server is listening in ports 443 and 80:

# netstat -tlnup | grep httpd
tcp6       0      0 :::80                   :::*                    LISTEN      6186/httpd          
tcp6       0      0 :::443                  :::*                    LISTEN      6186/httpd   

After every Apache reboot, in error_log I get:

[ssl:warn] [pid 6186] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)

But the CN for my certificate is effectively a wildcard:

# openssl x509 -in /etc/pki/tls/certs/domain.com.crt -noout -subject
subject= ********************* O= ************ OU=************ OU=***************** CN=*.domain.com

My apache conf file is:

ServerName my.domain.com
<VirtualHost *:80>
   ServerAlias *.domain.com
   Redirect / https://my.domain.com/
</VirtualHost>

<VirtualHost *:443>
    ServerAlias *.domain.com
        DocumentRoot /var/www/html/glpi
        ErrorLog /var/log/httpd/glpi.log
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/domain.com.crt
    SSLCertificateKeyFile /etc/pki/tls/private/domain.com.key
</VirtualHost>

Doing local curl tests I have the following:

# curl https://localhost
curl: (60) Peer's Certificate issuer is not recognized.

# curl -k https://localhost
Answer OK

# curl -v https://localhost
* About to connect() to localhost port 443 (#0)
*   Trying ::1...
* Connected to localhost (::1) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=*.domain.com,OU=*************************
*   common name: *.domain.com
*   issuer: CN=Trusted Secure Certificate Authority
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Where is the error and why was it working before reboot?

  • When you mean that the webpage is not opening I suppose that it tries to load the webpage but that it does not achieve it. The message that you get for SSL is a warning; have you checked your access.log file to see if there is something weird? – Dasel Nov 21 at 9:33
  • @Dasel That is, I try to load the webpage but no answer from my server. Nothing reported in access_log when trying to connect from outside. – Zumo de Vidrio Nov 21 at 9:36
  • It appears your apache is only listening on IPv6? Are you accessing it via IPv6? – Panki Nov 21 at 9:39
  • Try to add some debugging to Apache and/or curl like curl -v https://localhost. – Lambert Nov 21 at 9:43
  • 2
    Got it... firewalld was enabled so after reboot it became up... Confusing logs messages made me analyze in the wrong way. – Zumo de Vidrio Nov 21 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.