SSL configuration FAQ
1. How do I auto-redirect http to https?
Two ways: add a 301 redirect to https on the server; or add a redirect snippet in the page, e.g. <meta http-equiv="Refresh" content="seconds; url=target">.
2. Multiple servers / domains — which certificate?
Usually one domain = one certificate (certificates are bound to a domain). Only wildcard and multi-domain certificates cover many names: a wildcard covers subdomains of one domain on one physical server (Common Name *.mydomain.com); a multi-domain (SAN) covers arbitrary different domains. Both are for a single physical server; multiple physical servers sharing one domain (load balancing) need a multi-server license.
3. Intermediate expired when some clients hit IIS?
The server has multiple intermediate certificates including an expired one, and the client validates only via the expired intermediate. Fix: delete the expired certificate under the computer account's Intermediate Certification Authorities, install the latest intermediate, and force clients to fetch the newest chain.
4. Certificate extracted from the email fails to install?
Possible causes: (1) stray spaces/invalid characters, or missing BEGIN/END markers — double-click the file on Windows to check; (2) the original request was deleted or overwritten and the key is lost — revoke and reissue; (3) insufficient key permissions — log in as administrator and grant key management rights.
5. Can IIS submit multiple requests for one site?
IIS 6.0 allows only one pending CSR per site; creating a new CSR overwrites the original request and key. After submitting a CSR, avoid further certificate configuration and back up the key.
6. Apache EV cert has two intermediates and fails to start?
Combine the two intermediates into one file (copy both certificate blocks into a single file) and point SSLCertificateChainFile at it.
7. How to generate a PEM key and CSR?
Install OpenSSL and generate the request; when creating the private key, simply give it a .pem extension.
8. IIS: back up the key after submitting a CSR but before receiving the cert?
Open MMC, add the Certificates snap-in for the computer account; under Certificate Enrollment Requests find your request and export it as a PFX. When installing, import the key backup into Certificate Enrollment Requests first, then import the server certificate into Personal, and assign it to the site in IIS.
9. Why does a secure site warn about insecure content?
Mixed content. Use relative paths for URLs and resources so both http and https work; if you force https, ensure all images, Flash, JS and CSS use https absolute or relative paths.
10. How is an SSL session established?
The client sends client_hello (supported SSL versions, a 32-byte random, session ID, cipher list, compression list); the server replies with server_hello (chosen version, a 32-byte random, session ID, chosen cipher, compression); the client validates the server certificate and parameters (and returns its X.509 certificate if client auth is requested); both derive keys from the exchanged randoms, send change_cipher_spec, and encrypt all further traffic after the handshake.
11. Does mutual authentication need a third-party plugin?
No. Common web middleware supports client authentication — just change the configuration to enable it.
12. What happens to the certificate if the physical server fails?
Back up the certificate (private and public keys) right after issuance; on failure, deploy the backup to a new server.
13. Does a certificate hurt speed and traffic?
It adds CPU load for encryption/decryption, usually modest. Tips: (1) enable SSL only on pages that need it (e.g. login), not the busiest home page; (2) avoid large images/files on SSL pages. For very high traffic, use an SSL accelerator card or add servers.
14. Do network devices support SSL certificates?
It depends on the hardware; vendors provide configuration docs. Cisco, F5 VPN and others have certificate-capable products.
15. Do I re-issue after changing hardware/software?
The certificate is independent of hardware; the same OS and web-server version are fine; changing the domain requires re-issuance. Certificates cannot be moved between platforms.
16. Hosting provider won't allow an SSL certificate?
Shared-hosting providers run many virtual sites on one server, usually plain port 80; enabling SSL on one site adds load to the whole server.
17. Can multiple virtual hosts on one server run SSL?
Yes. One public IP with many sites needs a single multi-domain certificate; multiple sites each with their own IP can use separate certificates.
18. Certificate shows expired but isn't?
Likely (1) wrong system time or (2) an expired intermediate.
19. Double-clicking the certificate reports an invalid format?
The file may contain other certificates from its chain — rename it with a .p7b extension.
20. WebLogic reports key/cert mismatch?
When key and certificate are both correct, it usually means the intermediate CA isn't installed; deploy the certificate to a site whose domain matches the certificate Common Name (CN must equal the URL).
21. How to import a pfx certificate in IIS?
On Windows 2003, IIS Directory Security offers a pfx import option; on other systems, double-click the pfx to import it into the system, then assign the existing certificate.