Windows XP keeps using the snakeoil certificate that Ubuntu shipped with, despite the fact that it has never been used in any virtual host ever.
The certificate is located at
/etc/ssl/certs/ssl-cert-snakeoil.pem
I'm not sure where the key is. The only one I see that seems plausible is at
/etc/ssl/private/ssl-cert-snakeoil.key
I think the CA certificat is at
/etc/ssl/certs/ca-certificates.crt
but I'm just not sure.
So far I've tried various openssl commands, such as
openssl ca -keyfile /etc/ssl/private/ssl-cert-snakeoil.key \
-revoke /etc/ssl/certs/ssl-cert-snakeoil.pem \
-cert /etc/ssl/certs/ca-certificates.crt
The output from that one was
Using configuration from /usr/lib/ssl/openssl.cnf
CA certificate and CA private key do not match
14805:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406:
I'm all out of ideas. Any help is greatly appreciated.
EDIT
Here is what happened:
I bought a certificate from GeoTrust, installed it, activated the new virtualhost using that certificate, and restarted apache2. At no point in the lifetime of this server has any other certificate ever been used to secure web traffic, let alone the snakeoil certificate. Windows Vista and up, as well as OSX and all Linux distributions that I've tested use the correct certificate. Windows XP uses the snakeoil certificate (in IE. No other browsers on that VM). Here are some screenshots:
Best Answer
Given the extra information you've provided, it is probably easier for me to start another answer.
It doesn't appear that the dummy "snakeoil" certificate is being presented to the Windows client. The "snakeoil" certificate is generated with a subject of
CN=Ubuntu
, while the certificate being presented to the Windows box has a subject ofCN=Production
. So we're looking at a third certificate here.I can see the same certificate if I connect to your server with OpenSSL's
s_client
:What I believe is happening is that you've configured your web server to use the Server Name Indication extension. This extension is designed to let a server present different certificates depending on which host name the client wants to connect to.
This works fine in most modern browsers, but does not work in Internet Explorer on Windows versions prior to Vista. At this point, it seems highly unlikely that Microsoft will update the SSL libraries on Windows XP to support the SNI extension.
If you need your site to work with Internet Explorer on XP, see if you can remove the references to this other SSL host running on the same IP address from your Apache configuration.