0

I'm trying to get the SSL updated on a Ubuntu/Apache server. I've put the files into the proper places, but the config validator says it can't find the .key file.

I've verified that the file is there, hopefully with the proper permissions. And I'm just stumped at this point.

Screenshot of an ls output as well as validator output.  File names have been verified to match, but are blacked out due to naming.

5
  • Only root has read permissions for them. Do you launch the server as root? Furthermore: do not redact information, and do not post text as images. Also, post relevant sections of your config.
    – vidarlo
    Aug 8, 2022 at 20:24
  • 1
    Please do not post screenshots of the terminal. Always copy the text from the terminal and paste it in your question. Then format the text as code using the {_} icon above the edit window.
    – user68186
    Aug 8, 2022 at 20:26
  • and post line 33 if you can not figure out the error
    – Rinzwind
    Aug 8, 2022 at 20:46
  • The redacted words are the name of the domain, effectively. And I'm not at liberty to post them as a result. Doesn't the group have read permissions to the file, as it's currently configured?
    – Kent Bunn
    Aug 8, 2022 at 21:08
  • 1
    Line 33 of the config is: SSLCertificateKeyFile /etc/ssl/private/domain.key
    – Kent Bunn
    Aug 8, 2022 at 21:14

1 Answer 1

0

Regardless of web server, there are two components you need for an SSL certificate to work on the server: the certificate and its CA chain, and the keys.

If you have a certificate for your domain and a corresponding key, then you need to upload those to the server somewhere that Apache can read them. Apache runs as www-data, but I believe its master process runs as root to read SSL certs and config files that are not open to www-data and then drops privileges.

My suggestion is you do the following steps:

  1. Create a directory in /etc/ssl for your certificate and private key file to live - sudo mkdir /etc/ssl/osticket/ for example

  2. Copy the contents of your certificate file into a file osticket.crt in the /etc/ssl/osticket/ folder. You may need to use sudo with whatever text editor you prefer on the environment.

  3. Copy the contents of your private key file into a file osticket.priv.pem in the /etc/ssl/osticket/ folder.

  4. Update your Apache configuration as follows:

    SSLCertificateFile /etc/ssl/osticket/osticket.crt
    SSLCertificateKeyFile /etc/ssl/osticket/osticket.priv.pem
    
  5. Restart the apache service - sudo systemctl restart apache2

Then try accessing your site.

4
  • Line 32 of the config pointed to the .crt file, and wasn't throwing an error. My understanding is that the .key file should at least in theory be in a 'secure" location, and not a public one. Although that's less of a concern in this case, since the server isn't publicly accessible.
    – Kent Bunn
    Aug 9, 2022 at 16:22
  • 1
    @KentBunn your path says it doesnt exist. That means Apache cant see it. Unless you have direct server access that "key" isnt going to be visible to the world. Either way, Apache has to be able to see it, so. If you want to go a step further, encrypt the key and then the PW is needed at apache service start to decrypt it. Then nobody can just 'use' the key because it'll have a key password that only you would know. This breaks automated service startups, though, as you would have to be present for every system / service reboot to fix the Apache password so it can start.
    – Thomas Ward
    Aug 9, 2022 at 16:42
  • That worked, and I thank you. I'm still clueless why it wasn't work in the other file location, but at this point I'll take the win any way I can. :) A working secure website is good enough now. :)
    – Kent Bunn
    Aug 9, 2022 at 17:38
  • It didn't work because the file path that was defined in there never existed ;) Because it didn't exist on system it could not be found by Apache. Nonexistent directories are nonexistent :P Or the file was not readable by your user. In either case, putting it somewhere both you AND apache can access it solves the problem.
    – Thomas Ward
    Aug 9, 2022 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .