Setup an SSL certificate on an EC2 instance

amazon-ec2, amazon-web-services, linux, ssl, ssl-certificate

Solution

Sometimes this section

<VirtualHost _default_:443>

prevents your real SSL certificate from being used. If this is the case either comment VirtualHost default or move the SSLCertificate* attributes to it, ie.

<VirtualHost _default_:443>
  SSLCertificateKeyFile /etc/ssl/mydomain_com.key
  SSLCertificateFile /etc/ssl/mydomain_com.crt
  SSLCertificateChainFile /etc/ssl/mydomain_com.ca-bundle
</VirtualHost>

Make sure you restart apache after that.

Problem

I'm having hard time trying to setup an SSL certificate (it's a Comodo PositiveSSL purshased from NameCheap) on my EC2 micro instance (I'm using Amazon Linux AMI 2012.3, which is based on CentOS if I'm not mistaken). Here's what I did: I installed mod_ssl & OpenSSL I enabled port 443 on my EC2's instance security group I CHMODed the *.key & *.crt files to 777 as Comodo suggested I'm certain the IP address & files path are correct (put a bunch of 0s in the example but it is correct in my ssl.conf) I added this VirtualHost entry to ssl.conf ``` <VirtualHost 00.000.000.00:443> ############# I tried both with & without this section ############## ServerName www.mydomain.com:443 ServerAlias www.mydomain.com DocumentRoot /var/www ServerAdmin webmaster@mydomain.com ###################################################################### SSLEngine on SSLCertificateKeyFile /etc/ssl/mydomain_com.key SSLCertificateFile /etc/ssl/mydomain_com.crt SSLCertificateChainFile /etc/ssl/mydomain_com.ca-bundle </VirtualHost> ``` Then I restarted apache...but I stil cannot access https://www.mydomain.com/ !!! I checked with ssltool.com, it says ``` The Common Name on the certificate is: ip-00-00-00-000 The certificate chain consists of: SomeOrganization, ip-00-00-00-000. Expires on: Apr 10 13:39:41 2013 GMT - that's 363 days from today. The site tested mydomain.com is NOT the same as the Subject CN ip-00-00-00-000!. ``` I even went & copied the VistualHost to httpd.conf instead of ssl.conf & restarted apache, all in vain. I've been banging my head against the wall for days now. I'm pretty sure I'm missing a tiny something to make this work, I just don't know what exactly. I'd be infinitely grateful if someone can suggest something to make this work!

Original source