Untrusted certificate - Apache & StartSSL

Question

Trying to setup SSL on Apache (on AWS Linux). Firefox gives me these details in it's nastygram:

The certificate is not trusted because it is self-signed. 
The certificate is only valid for ip-###-##-#-##

I'm currently working under the assumption that this is a problem with the ChainFile or CA cert - quite possibly because I dont have the correct info in httpd.conf. Can you comment on the code below or let me know where else to look for the error?

httpd.conf:

<VirtualHost *:443>
DocumentRoot /var/www/html
ServerName https://###-##-#-##
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM

SSLCertificateFile /home/ec2-user/StartSSLcert.pem
SSLCertificateKeyFile /home/ec2-user/StartSSLkey.pem
SSLCertificateChainFile /home/ec2-user/sub.class1.server.sha1.ca.pem
SSLCACertificateFile /home/ec2-user/ca.pem
</VirtualHost>

This page has been my primary reference: http://www.startssl.com/?app=21 However, it includes many lines of code not in other examples I've found online with no description of what they do.

I've been guess-and-checking between the example above and a simpler example like: http://www.sslshopper.com/apache-server-ssl-installation-instructions.html

Everything I try is either untrusted by Firefox or I get errors when restarting apache. Ideas?

Answer 1

by default, the ssl settings in: /etc/httpd/conf.d/ssl.conf

override the corresponding block in: /etc/httpd/conf/httpd.conf

When using AWS you need to edit ssl.conf

"The certificate is only valid for ip-###-##-#-##" 

credit due here: Cannot setup SSL keys on my apache server in AWS EC2

Answer 2

If your server have more than one IP address, replace the * with IP address inside""

See: http://httpd.apache.org/docs/2.4/mod/core.html#virtualhost

Whats more, make sure you create your private key, CSR correctly.

See:https://library.linode.com/security/ssl-certificates/commercial#sph_create-a-certificate-signing-request