Windows XP keeps using the snakeoil certificate that Ubuntu shipped with, despite the fact that it has never been used in any virtual host ever.

The certificate is located at


I'm not sure where the key is. The only one I see that seems plausible is at


I think the CA certificat is at


but I'm just not sure.

So far I've tried various openssl commands, such as

openssl ca -keyfile /etc/ssl/private/ssl-cert-snakeoil.key \
    -revoke /etc/ssl/certs/ssl-cert-snakeoil.pem \
    -cert /etc/ssl/certs/ca-certificates.crt

The output from that one was

Using configuration from /usr/lib/ssl/openssl.cnf
CA certificate and CA private key do not match
14805:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406:

I'm all out of ideas. Any help is greatly appreciated.


Here is what happened:

I bought a certificate from GeoTrust, installed it, activated the new virtualhost using that certificate, and restarted apache2. At no point in the lifetime of this server has any other certificate ever been used to secure web traffic, let alone the snakeoil certificate. Windows Vista and up, as well as OSX and all Linux distributions that I've tested use the correct certificate. Windows XP uses the snakeoil certificate (in IE. No other browsers on that VM). Here are some screenshots:

The correct certificate loaded in Chrome

The incorrect certificate loaded in IE 8 on Windows XP

2 Answers 2


Given the extra information you've provided, it is probably easier for me to start another answer.

It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of CN=Ubuntu, while the certificate being presented to the Windows box has a subject of CN=Production. So we're looking at a third certificate here.

I can see the same certificate if I connect to your server with OpenSSL's s_client:

$ openssl s_client -connect portal.avendimedia.com:443
Certificate chain
 0 s:/CN=Production

What I believe is happening is that you've configured your web server to use the Server Name Indication extension. This extension is designed to let a server present different certificates depending on which host name the client wants to connect to.

This works fine in most modern browsers, but does not work in Internet Explorer on Windows versions prior to Vista. At this point, it seems highly unlikely that Microsoft will update the SSL libraries on Windows XP to support the SNI extension.

If you need your site to work with Internet Explorer on XP, see if you can remove the references to this other SSL host running on the same IP address from your Apache configuration.

  • Fantastic explanation of what's going on here. Thanks a million! Turns out there was another SSL host active, just not apparent (appended to the vhost config file). Stupid stupid oversight on my part... Mar 17, 2012 at 23:08

The "snakeoil" certificate is automatically generated when the ssl-cert package is installed.

It is a self signed certificate, so revoking it doesn't make much sense. You can easily generate a new one though:

sudo make-ssl-cert generate-default-snakeoil --force-overwrite

You will probably have to restart any service that was making use of that certificate for the change to take effect.

When you say that Windows XP keeps on using the certificate, what do you mean exactly though? If you had told your web browser on that computer to trust the particular snakeoil certificate generated by your Ubuntu system, it should be a simple matter to revoke that trust in the browser's certificate management interface.

  • I updated my question with more details. Mar 17, 2012 at 1:06
  • Worked in one swift... Apr 1, 2016 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .