Differences

This shows you the differences between two versions of the page.

--- creating_valid_startssl_certificates [31.12.2011 11:35] – Pascal Suter
+++ creating_valid_startssl_certificates [26.07.2015 09:04] – Pascal Suter
@@ Line 23: / Line 23: @@
   cat > server.crt
 then paste the certificate and hit return and then ctrl+D
+now download the [[http://www.startssl.com/certs/sub.class1.server.ca.pem|Certificate Chain File]] to your server
+last but not least you need to make sure your apache ssl config is pointing to those files. make sure you have these lines in your virtual host configuration to enable and configure ssl for your site. of course you need to make sure the paths match your setup :)
+<code>
+        SSLEngine on
+        SSLProtocol all -SSLv2
+        SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
+        SSLCertificateFile    /etc/ssl/certs/server.crt
+        SSLCertificateKeyFile /etc/ssl/certs/server.key
+        SSLCertificateChainFile /etc/ssl/certs/sub.class1.server.ca.pem
+</code>
+now **reload apache**
+==== sec_error_ocsp_unknown_cert ====
+shortly after updating (orp probalby also creating) a certificate with startssl firefox might not allow you to access the site, returning an error sec_error_ocsp_unknown_cert. this is because apparently startssl's ocsp server needs to reload its cached entries first in order for the new certificates to be usable through firefox. so just allow it some time to catch up and it should all work.