SSLCertificateChainFile Deprecation Warning on Apache 2.4.8+
I had the same issue. I just replaced these lines in /etc/apache2/site-enabled/default-ssl.conf
SSLCertificateFile /etc/ssl/certs/domain.crt
SSLCertificateKeyFile /etc/ssl/private/domain.key
#SSLCertificateChainFile /etc/apache2/ssl.crt/chain.crt
As you see, I just commented out the SSLCertificateChainFile
. Then, seeing the same error as you, I concatenated the content of my chain.crt
at the end of the domain.crt
, like so:
root@host~: cat /etc/apache2/ssl.crt/chain.crt >> /etc/ssl/certs/domain.crt
And it worked like a charm.
I use the following script to create a certificate bundle that contains the chained certificate.
#!/bin/sh
#
# Convert PEM Certificate to ca-bundle.crt format
#
test ! $1 && printf "Usage: `basename $0` certificate" && exit 1
# Friendly Name and Underline Friendly Name with equal signs
openssl x509 -in $1 -text -noout | sed -e 's/^ *Subject:.*CN=\([^,]*\).*/\1/p;t c' -e 'd;:c' -e 's/./=/g'
# Output Fingerprint and swap = for :
openssl x509 -in $1 -noout -fingerprint | sed -e 's/=/: /'
# Output PEM Data:
echo 'PEM Data:'
# Output Certificate
openssl x509 -in $1
# Output Certificate text swapping Certificate with Certificate Ingredients
openssl x509 -in $1 -text -noout | sed -e 's/^Certificate:/Certificate Ingredients:/'
To use it, starting with the server certificate and sequentially through any intermediary certificates in the certificate chain back to the root certificate.
./bundle.sh myserver.crt >myserver.chain
./bundle.sh intermediate.crt >>myserver.chain
./bundle.sh root.crt >>myserver.chain
where the appropriate certificate names are replaced with your real certificate name.