apache的证书文件-crt，pem，key，p7b…我迷路了

Question

i have a Question about the certificate files and how to get a site to run on SSL. Apache is running and SSL is built in. i am past the SSLSessionCache warning and here i am - every time the same problem - i get a mail with some files and i do not know which file is what.

I have a .key, .pem and a .p7b file and i have the VirtualHost config - how do i know which file is what?

• SSLCertificateFile ?
• SSLCertificateKeyFile <-- .key (i think)
• SSLCertificateChainFile ?

and do i need to convert a file with openssl?

This Server is an internal Server and the certificate was issued in our company.

Answer 1

the certificate was issued in our company.

Any reason to not ask whoever issued the certificate the meaning of each file?

Apache requires the key and the certificate to be PEM-encoded. You can use this tool or OpenSSL to convert the . p7b to PEM.

It's hard to know what's inside the .pem and .key file without looking at the content. You can try to use the following OpenSSL commands to check which one does not fail:

# if it works, it's a CSR
openssl req -in file.pem -noout -text
# if it works, it's a certificate
openssl x509 -in file.pem -noout -text
# if it works, it's a private key
openssl rsa -in file.pem -noout -text

The chain file it's easier to spot, because it will contain several PEM-encoded certificates listed one after the other.

Depending on the Apache version, you may or may not need the SSLCertificateChainFile directive. Newer versions require you to bundle the chain and the server certificate in a single file and pass it to SSLCertificateFile . Check your Apache version and compare it with the online documentation.

Assuming it's an old version:

• SSLCertificateFile points to the server certificate file
• SSLCertificateChainFile points to the intermediate certificate (if it's self-signed, you don't have them)
• SSLCertificateKeyFile points to the key

If it's a newer version, ignore SSLCertificateChainFile and concatenate the server plus the chain (if any) in a single file you supply to SSLCertificateFile .