If you are finding that some browsers are talking to your new Apache/OpenSSL install,
while some are pulling a total blank (looks like a connection refused
or server not found), and you are getting this error:
…
then heed the warning. You are likely using the DSA server
certificate that comes with some fresh installs. Check your cert
directories:
ls -l /etc/httpd/conf/ssl.key
Do you see that your server.crt (or whatever your httpd.conf defines as
your cert) and your server.key (or whatever is your key) are symbolic
links to the default “snakeoil” certs?
server.key -> snakeoil-dsa.key
Ok, then you might have better luck in using the RSA versions, which play nice with more browsers:
ln -s snakeoil-rsa.crt server.crt
mv server.key server.key.orig
apachectl stop && apachectl start
(Remembering that with Apache, when playing with SSL stuff, do a full stop and start upon making changes — a HUP won’t cut it)
As per all recommendations, do away with the snakeoil stuff ASAP and certainly before putting anything up on a public network.
CAVEAT: Do not use this advice for production. This advice should
only be used for your own dev or testing, in order to get a fresh
install at least nominally working. If you want real SSL and
can’t figure it out, pay someone, because your security is worth it.