Does anyone fancy themselves an apache guru?

J

Jake

Supreme [H]ardness
Joined
Mar 17, 2000
Messages
4,651
I've got some strange issues on a server of mine here at work. I'd like some opinions if possible. Or does this belong in networking?

I've got a apache2 server running (in our DMZ, it is NATed to the outside) as a reverse proxy to a tomcat 5 app server inside our network.

I've got a verisign cert on the apache 2 box installed, and it sorta works, but it claims that it mismatches:

IE on my windows box says that it:
(green check)"The security certificate is from a trusted certifying authority"
(yellow !) The security certificate has expired or is not yet valid
(green check) The security certificate has a valid name matching the name of the page you are trying to view.
Proceed: Yes/No/View Cert

Firefox 1.0.2 on my windows box accepts it and doesn't prompt. (I don't recall ever accepting the cert or installing it.) It is not in the listing of certs I've accepted.

Firefox 1.0.1 on my linux box says:
Unable to verify the identity of xxx as a trusted site
Possible reasons for this error:
Your browser does not recognize the Certificate authority that issued the site's certificate (WTF its Verisign!!!???)
The site's certificate is incomplete due to a server misconfiguration (quite possible, I'm somewhat new to this)
You are connected to a site pretending to be xxx, possibly to obtain your confidental information.

Accept Permanently
Accept temporarily for this session
Do not accept this cert. and do not connect

This is all just trying to view the default apache/redhat page with https://

Any hints on apache configuration?
 
upgraded linux firefox to 1.0.2 and it has the same message.

konqueror 3.3.2 says: "The server certificate failed the authenticity test"
details: Certificate state: (in red) Certificate signing authority is unknown or invalid.
 
also Please check this out, if java is invloved anywhere in the chain:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57436-1

3. Symptoms Class 3 Verisign PCA root certificate:




"it is highly unlikely that you will encounter a web site with a SSL server certificate that is a subordinate certificate of the expiring Class 3 Verisign PCA root certificate. In addition, Java applications and applets signed after August 2002 should not be signed by a code signing certificate that is a subordinate certificate of the expiring Class 3 Verisign PCA root certificate. (See Note 1 below.) However, even if the root CA certificate of a code signers certificate or a web site's SSL server certificate is the new Class 3 Verisign PCA root certificate, you may still see one of the above security warnings if the certificate chain does not include the root CA certificate."
 
if anything the system time might be off an hour since daylight savings. I'll check it though.

Java shouldn't be anywhere near that server, it is just running Apache2. Unless someone else put it on.

So I'll have to import a new intermediate (chain) cert and root cert?

Thanks for the hints man.
 
Ok this seems hella dumb, my local workstation's IE has several out of date intermediate certificates, including 2 from Verisign. I delete those and import the correct one, and BAM it works.

Firefox doesn't have any intermediates so if I import it into there it works with out prompting as well.


:rolleyes:
 
XP SP1 at work, ie 6.0.(2800 I think) expired intermediate cert
XP SP2 at home, ie 6.0.2900 expired intermediate cert

Firefox: didn't have any of the intermediate certs.
 
You must log in or register to reply here.
Back
Top