Apache server SSL invalid certificate error on valid cert

I installed an SSL certificate on an Apache web server, running on Ubuntu 14.04, approximately 3 months ago.  The certificate was purchased through Digicert and is valid through 2017.  However, about a week ago the site started displaying an error message, saying the certificate was invalid.  I restarted Apache and that seemed to solve the problem.  But just yesterday the error returned. I restarted Apache a 2nd time and again, everything is working fine. But now I'm concerned that rebooting is just a temporary solution.
kmgishAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

vipeliteCommented:
Contact DigiCert. and make sure you have all root files installed on your server.
0
kmgishAuthor Commented:
By root files, do you mean the applicable crt, csr and key files?  If so, they are installed.  The certificate is currently working fine.  If they weren't installed correctly, wouldn't it not work at all?
0
vipeliteCommented:
Let's hope that is the case. Next time you get error you should take some captures from the server and see exactly what's going on before restarting and could be another issue that's causing it to break like a network issue.
0
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

kmgishAuthor Commented:
Yeah, about 3 seconds after I restarted the second time, I realized I should have tried to do some better detective work, but I had people breathing down my neck to get things working again.  And unfortunately, the server runs the company's intranet, that lives behind a firewall, so I can't share any links, or anything like that.

Do you know of any specific log files I should be looking at?  I've looked at error.log and error_ssl.log, but I don't see anything out of the ordinary in either of those.

Thanks for your help, BTW.
0
gheistCommented:
You can check with qualys ssl server test what is wrong: https://www.ssllabs.com/ssltest/
Namely SHA1 certificates get marked as bad in browsers recently, not to mention that SSLv3 disablement is just a matter of weeks.
Or share your SSL domain name, i will run same test and share observations.
0
kmgishAuthor Commented:
Hi gheist,

Thanks for your response. Unfortunately, I can't run those tests or share the link, since this is an intranet site, behind a firewall.  But I can tell you that the cert doesn't support SSLv3 or SHA1.  It was keyed just 3 months ago.

I was just curious if anyone here had ever experienced an SSL cert that was working fine for months and then all of a sudden stopped working, where a reboot seemingly fixed the problem.
0
vipeliteCommented:
Have you checked internally for any Hostname/DNS changes could possibly be one. DNS may have refreshed a change and server didn't like it. I don't know throwing things out there. Especially if you're not seeing any errors on the actual server. Also, when you say behind a FW is it behind a DMZ or is it only accessible via internal network?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
kmgishAuthor Commented:
vipelite,  Thanks, I appreciate any ideas, thrown or otherwise.

I'll check with our lead network administrator to see if there's been any DNS changes that might be the culprit.  To answer your question, the site is only accessible via an internal network.
0
gheistCommented:
I assume you changed certificate and did not change certificate chain.
Since you dont share the link I have no way to guess which certificate chain you need.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.