1

So I have an SSL enabled website running on Apache2.

https://eamorr.com (I get a warning in my browser, as expected)

I have a config file for this website at:

/etc/apache2/sites-available/eamorr.com-ssl.conf

Inside this file, I have the following lines:

SSLCertificateFile      /etc/apache2/ssl/eamorr.com/eamorr.com.crt
SSLCertificateKeyFile   /etc/apache2/ssl/eamorr.com/eamorr.com.key

"eamorr.com.crt" and "eamorr.com.key" were generated by (i.e. self-signed):

openssl genrsa -out eamorr.com.key 2048
openssl req -new -x509 -key eamorr.com.key -out eamorr.com.crt -days 30000
mv eamorr.com.* /etc/apache2/ssl/eamorr.com/
apache2ctl restart

OK, great. I have a working https website with an SSL warning.

Now, I decided to create my own certificate authority (CA) and install this CA on my local computer (I'm using Apple OSX operating system).

So, back on my website's server, using two steps, I sign "eamorr.com.key" using my own CA:

1. sudo openssl req -new -key /etc/apache2/ssl/eamorr.com/eamorr.com.key -out /etc/apache2/ssl/eamorr.com/eamorr.com.csr   #generates the certificate signing request (CSR)
2. sudo openssl ca -in /etc/apache2/ssl/eamorr.com/eamorr.com.csr -config ./openssl.cnf

I'm now given a new certificate that's printed on screen. I copied and pasted this certificate into /etc/apache2/ssl/eamorr.com/eamorr.com.crt

I then added another line to the Apache2 configuration for the site:

SSLCertificateChainFile /home/eamorr/ca/eamorr.comCA.crt

, where "eamorr.comCA.crt" is my CA's cert

apache2ctl restart

But what do I do now? I'm stuck!

Even though I've installed my CA's public key into my operating system, I'm still getting this error in Firefox:

Firefox error

"invalid security certificate"?

"the issuer certificate is unknown"?

But I imported my custom CA certificate (eamorr.comCA.crt) into my operating system (Apple OSX - imported into System certificates using the "KeyChain Access" program)???

Can anyone help me?

  • 3
    Firefox uses its own certificate store, unrelated to your OS store. Have you tried to add it to the firefox store? – user10008 Dec 30 '14 at 13:45
  • Hi @user10008. You are dead right. When I exited Firefox, deleted "cert8.db" from my Firefox profile (/Users/eamorr/Library/Application Support/Firefox/Profiles/u238329.default/ on my Mac), restarted Firefox and imported my certificate (Firefox -> Preferences -> Advanced -> Certificates -> View Certificates -> Authorities -> Import); it worked fine! Chrome and Safari worked perfectly - no modifications required. Thank you for your help!!! – Eamorr Dec 30 '14 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.