Subject: netscape warning message

From: "Austin Conger (IT)" <[email-masked]>
Date: Tue, 1 Apr 2003 15:51:39 -0500

Hi All,
 
When I view my ssl pages in Netscape 7.x, I am getting a, Website Certified by an Unknown Authority, popup message.
I am using Apache/2.0.43 and mod_ssl with openssl 0.9.6g running under Solaris 8.
 
I am assuming its a configuration issue as the certificate is signed by Verisign and it works fine in IE.  I am using virtual hosts with separate IPs.
 
What could be causing this to occur?  What errors might my httpd.conf file contain?
 
Thanks,
 
Austin

Some of my httpd configuration is as follows:
 
Listen 10.0.0.26:80
Listen 10.0.0.27:80

ServerName 10.0.0.26:80

<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>

NameVirtualHost 10.0.0.27
 
<VirtualHost 10.0.0.27>
    DocumentRoot /site/htdocs/vhost
    RewriteEngine On
    RewriteRule ^/.* /site/htdocs/vhost/index.html
</VirtualHost>
 
<VirtualHost 10.0.0.27>
    ServerName www.domain2.com
    ServerPath /domain2/
    DocumentRoot /site/htdocs/domain2
    RewriteEngine On
    RewriteRule ^(/domain2/.*) /site/vhost$1
</VirtualHost>
 
<VirtualHost 10.0.0.27>
    ServerName www.domain3.com
    ServerPath /domain3/
    DocumentRoot /site/htdocs/domain3
    RewriteEngine On
    RewriteRule ^(/domain3/.*) /site/vhost$1
</VirtualHost>
 
<VirtualHost _default_:443>
    DocumentRoot /site/htdocs/
    ServerName  www.domain.com
    ServerAdmin  [email-masked]
    ErrorLog /site/logs/error_log
    TransferLog /site/logs/access_log
 
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
 
    SSLCertificateFile /usr/local/ssl/certs/verisigned.cert
 
    SSLCertificateKeyFile /usr/local/ssl/private/domain.key
 
    SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
 
    CustomLog /site/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

And the this is my ssl.conf file:

<IfDefine SSL>
Listen 10.0.0.26:443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  builtin

SSLSessionCache         dbm:logs/ssl_scache
SSLSessionCacheTimeout  300

SSLMutex  file:logs/ssl_mutex

SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
 
<VirtualHost 10.0.0.26:443>

DocumentRoot "/site/htdocs"
ServerName www.domain.com
ServerAdmin a [email-masked] <mailto:[email-masked]> 
ErrorLog /site/logs/error_log
TransferLog /site/logs/access_log

SSLEngine on
 
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile /usr/local/ssl/certs/verisigned.cert

SSLCertificateKeyFile /usr/local/ssl/private/domain.key
 
SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog /site/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
</VirtualHost>
</IfDefine>

---

From: [email-masked]
Date: Wed, 2 Apr 2003 11:36:18 +0100

Have you restarted the httpd process since you put:

In your configuration? If not it will probably still be using the default
configuration, which I think will have a localhost.localdomain cert. I take
it that the above paths are where your key and certificate are?

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Anyone who believes in Evolution as fact just because they were told so at
school seems to have missed the relevance of the renaissance.

-----Original Message-----
From: Austin Conger (IT) [mailto:[email-masked]]
Sent: 01 April 2003 21:52
To: [email-masked]
Subject: netscape warning message

Hi All,

When I view my ssl pages in Netscape 7.x, I am getting a, Website Certified
by an Unknown Authority, popup message.
I am using Apache/2.0.43 and mod_ssl with openssl 0.9.6g running under
Solaris 8.

I am assuming its a configuration issue as the certificate is signed by
Verisign and it works fine in IE.  I am using virtual hosts with separate
IPs.

What could be causing this to occur?  What errors might my httpd.conf file
contain?

Thanks,

Austin

Listen 10.0.0.26:80
Listen 10.0.0.27:80

ServerName 10.0.0.26:80

<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>

<VirtualHost 10.0.0.27>

<VirtualHost 10.0.0.27>

<VirtualHost 10.0.0.27>

    SSLEngine on
    SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

<IfDefine SSL>
Listen 10.0.0.26:443

SSLEngine on

SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

</VirtualHost>
</IfDefine>

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Austin Conger (IT)" <[email-masked]>
Date: Wed, 2 Apr 2003 09:54:35 -0500

Hi John,

I have restarted the apache process several times since installing the new certificate.  I did have a self-signed cert installed first.  Could it be caching it somehow?  If so, is there a way to erase this cache?

Yes, these paths are the locations of my key and certificate.

thanks,

Austin

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, April 02, 2003 5:36 AM
To: [email-masked]
Subject: RE: netscape warning message

 

- 

-----Original Message-----
From: Austin Conger (IT) [mailto:[email-masked]]
Sent: 01 April 2003 21:52
To: [email-masked]
Subject: netscape warning message

Hi All,

Thanks,

Austin

Listen 10.0.0.26:80
Listen 10.0.0.27:80

ServerName 10.0.0.26:80

<IfModule mod_ssl.c>
Include conf/ssl.conf
</IfModule>

<VirtualHost 10.0.0.27>

<VirtualHost 10.0.0.27>

<VirtualHost 10.0.0.27>

    SSLEngine on
    SSLCipherSuite

<IfDefine SSL>
Listen 10.0.0.26:443

SSLEngine on

SSLCipherSuite

</VirtualHost>
</IfDefine>

-

---

From: [email-masked]
Date: Wed, 2 Apr 2003 16:21:49 +0100

I missed the bit about it working on IE, which indicates that it must have
worked at some point. However, IE has its own unique form of caching which
sometimes takes a deletion of temporary Internet files and a reboot.
Netscape IIRC creates a .netscape/cache directory on Linux machines, but
it's been a long time since I used it on Windows so I don't know where that
would be. It too should have an option to remove them.

You could try deleting temporary Internet files on IE and see if it can
connect. Also check the logs generated by apache to see if there are any
warnings, eg being unable to open your key and certificate files. 

John

> Sent: 02 April 2003 15:55
> I have restarted the apache process several times since 
> installing the new certificate.  I did have a self-signed 
> cert installed first.  Could it be caching it somehow?  If 
> so, is there a way to erase this cache?
> 

-