How do I revoke the default snakeoil certificate?

Question

Windows XP keeps using the snakeoil certificate that Ubuntu shipped with, despite the fact that it has never been used in any virtual host ever.

The certificate is located at

/etc/ssl/certs/ssl-cert-snakeoil.pem

I'm not sure where the key is. The only one I see that seems plausible is at

/etc/ssl/private/ssl-cert-snakeoil.key

I think the CA certificat is at

/etc/ssl/certs/ca-certificates.crt

but I'm just not sure.

So far I've tried various openssl commands, such as

openssl ca -keyfile /etc/ssl/private/ssl-cert-snakeoil.key \
    -revoke /etc/ssl/certs/ssl-cert-snakeoil.pem \
    -cert /etc/ssl/certs/ca-certificates.crt

The output from that one was

Using configuration from /usr/lib/ssl/openssl.cnf
CA certificate and CA private key do not match
14805:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406:

I'm all out of ideas. Any help is greatly appreciated.

EDIT

Here is what happened:

I bought a certificate from GeoTrust, installed it, activated the new virtualhost using that certificate, and restarted apache2. At no point in the lifetime of this server has any other certificate ever been used to secure web traffic, let alone the snakeoil certificate. Windows Vista and up, as well as OSX and all Linux distributions that I've tested use the correct certificate. Windows XP uses the snakeoil certificate (in IE. No other browsers on that VM). Here are some screenshots:

Answer 1

Given the extra information you've provided, it is probably easier for me to start another answer.

It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of CN=Ubuntu, while the certificate being presented to the Windows box has a subject of CN=Production. So we're looking at a third certificate here.

I can see the same certificate if I connect to your server with OpenSSL's s_client:

$ openssl s_client -connect portal.avendimedia.com:443
...
Certificate chain
 0 s:/CN=Production
   i:/CN=Production
...

What I believe is happening is that you've configured your web server to use the Server Name Indication extension. This extension is designed to let a server present different certificates depending on which host name the client wants to connect to.

This works fine in most modern browsers, but does not work in Internet Explorer on Windows versions prior to Vista. At this point, it seems highly unlikely that Microsoft will update the SSL libraries on Windows XP to support the SNI extension.

If you need your site to work with Internet Explorer on XP, see if you can remove the references to this other SSL host running on the same IP address from your Apache configuration.

Answer 2

The "snakeoil" certificate is automatically generated when the ssl-cert package is installed.

It is a self signed certificate, so revoking it doesn't make much sense. You can easily generate a new one though:

sudo make-ssl-cert generate-default-snakeoil --force-overwrite

You will probably have to restart any service that was making use of that certificate for the change to take effect.

When you say that Windows XP keeps on using the certificate, what do you mean exactly though? If you had told your web browser on that computer to trust the particular snakeoil certificate generated by your Ubuntu system, it should be a simple matter to revoke that trust in the browser's certificate management interface.