How to fix browser unsecure icon for given apache config?

Question

Team,

While configure ssl.conf for apache 2.2.4, I want to use some configuration like below

 SSLEngine on
 SSLCertificateFile /opt/alfresco/deploy/ssl/crt/testdns.com.crt
 SSLCertificateKeyFile /opt/alfresco/deploy/ssl/private/testdns.com.key
 SSLCertificateChainFile /opt/alfresco/deploy/ssl/crt/intermediate.crt
 SSLVerifyClient none
 SSLVerifyDepth 1
 SSLOptions +StdEnvVars +StrictRequire
 SSLProtocol -ALL +TLSv1
 SetEnv nokeepalive ssl-unclean-shutdown
 SSLProtocol +TLSv1 +TLSV1.2

When I use +TLSv1 only it gives me some error like below for my API calls

javax.net.ssl.SSLException: Received fatal alert: protocol_version 

If I use both protocols SSLProtocol +TLSv1 +TLSv2 both, it gives browser unsecure icon, how do I prevent it?

Case is like below

If I use only +TLSv1  -  My API calls are working fine
If I use only +TLSv2  - browser shows secure icon but API call fails and give above error.

If I use both still browser shows unsecure icon. ()

Is there any solution of it , let me know.

Answer 1

I configured a web server with the same SSL options from your original post. The only difference is that I'm using a free SSL certificate from CertBot, which is a trusted provided. I was able to get the same results on Chrome and Edge. Here is the apache information and virtual host config.

[root@ip-172-26-6-250 conf.d]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

[root@ip-172-26-6-250 conf.d]# httpd -V
Server version: Apache/2.4.6 (CentOS)
Server built:   Aug  8 2019 11:41:18
Server's Module Magic Number: 20120211:24
Server loaded:  APR 1.4.8, APR-UTIL 1.5.2
Compiled using: APR 1.4.8, APR-UTIL 1.5.2
Architecture:   64-bit
Server MPM:     prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=256
 -D HTTPD_ROOT="/etc/httpd"
 -D SUEXEC_BIN="/usr/sbin/suexec"
 -D DEFAULT_PIDLOG="/run/httpd/httpd.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="conf/mime.types"
 -D SERVER_CONFIG_FILE="conf/httpd.conf"

Here is the virtual host config.

[root@ip-172-26-6-250 conf.d]# cat /etc/httpd/conf.d/heysus_xyz.conf
<VirtualHost *:80>
    DocumentRoot "/var/www/html/"
    ServerName heysus.xyz
</VirtualHost>

##Test Config
<VirtualHost *:443>

    DocumentRoot "/var/www/html/"
    ServerName heysus.xyz
    SSLEngine on
    SSLCertificateFile "/etc/letsencrypt/live/heysus.xyz/fullchain.pem"
    SSLCertificateKeyFile "/etc/letsencrypt/live/heysus.xyz/privkey.pem"

    SSLVerifyClient none
    SSLVerifyDepth 1
    SSLOptions +StdEnvVars +StrictRequire
    SSLProtocol -ALL +TLSv1
    SetEnv nokeepalive ssl-unclean-shutdown
    SSLProtocol +TLSv1 +TLSV1.2
</VirtualHost>

##Working config
#<VirtualHost *:443>
#    DocumentRoot "/var/www/html/"
#    ServerName heysus.xyz
#    SSLEngine on
#    SSLCertificateFile "/etc/letsencrypt/live/heysus.xyz/fullchain.pem"
#    SSLCertificateKeyFile "/etc/letsencrypt/live/heysus.xyz/privkey.pem"
#</VirtualHost>

I think the issue may be with your certificate. Make sure that the certificate is properly installed.

The server I used for testing will be live for a few days so that you can take a look.