Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of Roman.Fiedler@ait.ac.at
 designates 62.218.164.132 as permitted sender)
From: Fiedler Roman <Roman.Fiedler@ait.ac.at>
To: Robin Becker <robin@reportlab.com>,
        "users@httpd.apache.org"
	<users@httpd.apache.org>
Thread-Topic: AW: [users@httpd] ssl setup checking
Thread-Index: AQHOxOSixMFl3joYok6rCOSGjVHayZnsSGyg///hzACAACJp8A==
Date: Wed, 9 Oct 2013 12:32:53 +0000
Message-ID: <2ECE9D9EEF1F524185270138AE2326593BF71080@S0MSMAIL112.arc.local>
References: <52527D46.1080607@chamonix.reportlab.co.uk>
 <CAGBAQ44mK41q0TssSALQY3VVyPxXnnaoaez2UXs8b2at9usQqw@mail.gmail.com>
 <52554104.6040906@chamonix.reportlab.co.uk>
 <2ECE9D9EEF1F524185270138AE2326593BF71022@S0MSMAIL112.arc.local>
 <52554B70.20401@chamonix.reportlab.co.uk>
In-Reply-To: <52554B70.20401@chamonix.reportlab.co.uk>
Accept-Language: en-US, de-AT
Content-Language: de-DE
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: AW: AW: [users@httpd] ssl setup checking

> Von: Robin Becker [mailto:robin@reportlab.com]
>=20
> On 09/10/2013 13:15, Fiedler Roman wrote:
> ..........
> >
> > Unless you want to use client certificates from globalsign,
> "SSLCACertificateFile" will not make sense. See [1]
> >
> > Roman
> >
> > [1]
> http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatefile
> ..........
>=20
> This page https://support.globalsign.com/customer/portal/articles/1225234
> says
> explicitly that I need the SSLCACertificateFile directive

Strange, perhaps I misread the configuration or this is just required so th=
at NSA can login if you happen to want to use client-certificates also.

> > Your virtual host section will need to contain the following directives=
:
> >
> >     SSLCACertificateFile - This will need to point to the appropriate
> GlobalSign root CA certificate.
> >     SSLCertificateChainFile - This will need to point to the appropriat=
e
> intermediate root CA certificates you previously created in Step 1 above.
> >     SSLCertificateFile - This will need to point to the end entity cert=
ificate.
> This is the certificate you have called "mydomain.crt."
> >     SSLCertificateKeyFile - This will need to point to the private key =
file
> associated with your certificate.
>=20
> what I don't understand is where the cross certificate goes.

I've just put all chain certificates into " SSLCertificateChainFile", nothi=
ng else was required on apache2.2. But we had problems with some clients, t=
hat still did not want to accept the chain, mostly on mobile devices.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org