title: Trouble on setting SSL certificates for Virtual Hosts using Apache\Phusion Passenger in localhost
body: <p>I am using Ruby on Rails 3 and I would like to make to work HTTPS connections on <em>localhost</em>.</p>
  
  <p>I am using:</p>
  
  <ul>
  <li>Apache v2 + Phusion Passenger</li>
  <li>Mac OS + Snow Leopard v10.6.6</li>
  </ul>
  
  <p>My Ruby on Rails installation use the <a href="https://github.com/dbalatero/typhoeus" rel="nofollow">Typhoeus gem</a> (it is possible to use the Ruby net\http library but the result doesn't change) to make HTTP requests over HTTPS.</p>
  
  <p>I created self-signed <em>ca.key</em>, <em>pjtname.crt</em> and <em>pjtname.key</em> as <a href="http://developer.apple.com/internet/serverside/modssl.html" rel="nofollow">detailed on the Apple website</a>.</p>
  
  <p><em>Notice</em>: Following instruction from the Apple website, on running the <code>openssl req -new -key server.key -out server.csr</code> command (see the link) at this point </p>
  
  <pre><code>Common Name (eg, YOUR name) []: (this is the important one)
  </code></pre>
  
  <p>I entered <code>*pjtname.com</code> so that is valid for all sub_domain of that site.</p>
  
  <hr>
  
  <p>In my Apache <code>httpd.conf</code> I have two virtual hosts configured in this way:</p>
  
  <pre><code># Secure (SSL/TLS) connections
  #Include /private/etc/apache2/extra/httpd-ssl.conf
  #
  # Note: The following must must be present to support
  #       starting without SSL on platforms with no /dev/random equivalent
  #       but a statically compiled-in mod_ssl.
  #
  &lt;IfModule ssl_module&gt;
  SSLRandomSeed startup builtin
  SSLRandomSeed connect builtin
  &lt;/IfModule&gt;
  
  Include /private/etc/apache2/other/*.conf
  
  
  
  # Passenger configuration
     LoadModule passenger_module /Users/&lt;my_user_name&gt;/.rvm/gems/ruby-1.9.2-p136/gems/passenger-3.0.2/ext/apache2/mod_passenger.so
     PassengerRoot /Users/&lt;my_user_name&gt;/.rvm/gems/ruby-1.9.2-p136/gems/passenger-3.0.2
     PassengerRuby /Users/&lt;my_user_name&gt;/.rvm/wrappers/ruby-1.9.2-p136/ruby
  
  
  
  
  # Go ahead and accept connections for these vhosts
  # from non-SNI clients
  SSLStrictSNIVHostCheck off
  
  
  # Ensure that Apache listens on port 443
  Listen 443
  
  # Listen for virtual host requests on all IP addresses
  NameVirtualHost *:80
  NameVirtualHost *:443
  
  
  
  #
  # PJTNAME.COM and subdomains SETTING
  #
  
  
  
  &lt;VirtualHost *:443&gt;
    # Because this virtual host is defined first, it will
    # be used as the default if the hostname is not received
    # in the SSL handshake, e.g. if the browser doesn't support
    # SNI.
  
    ServerName pjtname.com:443
    DocumentRoot "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/pjtname.com/public"
  
    ServerAdmin you@example.com
    ErrorLog "/private/var/log/apache2/error_log"
    TransferLog "/private/var/log/apache2/access_log"
  
    RackEnv development
  
    &lt;Directory "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/pjtname.com/public"&gt;
      Order allow,deny
      Allow from all
    &lt;/Directory&gt;
  
    # SSL Configuration
    SSLEngine on
  
    # Self Signed certificates
    # Server Certificate
    SSLCertificateFile /private/etc/apache2/ssl/wildcard.certificate/pjtname.crt
    # Server Private Key
    SSLCertificateKeyFile /private/etc/apache2/ssl/wildcard.certificate/pjtname.key
    # Server Intermediate Bundle
    SSLCertificateChainFile /private/etc/apache2/ssl/wildcard.certificate/ca.crt
  &lt;/VirtualHost&gt;
  
  # HTTP Setting
  &lt;VirtualHost *:80&gt;
    ServerName pjtname.com
    DocumentRoot "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/pjtname.com/public"
  
    RackEnv development
  
    &lt;Directory "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/pjtname.com/public"&gt;
      Order allow,deny
      Allow from all
    &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  
  
  
  
  &lt;VirtualHost *:443&gt;
    ServerName users.pjtname.com:443
    DocumentRoot "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/users.pjtname.com/public"
  
    ServerAdmin you@example.com
    ErrorLog "/private/var/log/apache2/error_log"
    TransferLog "/private/var/log/apache2/access_log"
  
    RackEnv development
  
    &lt;Directory "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/users.pjtname.com/public"&gt;
      Order allow,deny
      Allow from all
    &lt;/Directory&gt;
  
    # SSL Configuration
    SSLEngine on
  
    # Self Signed certificates
    # Server Certificate
    SSLCertificateFile /private/etc/apache2/ssl/wildcard.certificate/pjtname.crt
    # Server Private Key
    SSLCertificateKeyFile /private/etc/apache2/ssl/wildcard.certificate/pjtname.key
    # Server Intermediate Bundle
    SSLCertificateChainFile /private/etc/apache2/ssl/wildcard.certificate/ca.crt
  &lt;/VirtualHost&gt;
  
  # HTTP Setting
  &lt;VirtualHost *:80&gt;
    ServerName users.pjtname.com
    DocumentRoot "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/users.pjtname.com/public"
  
    RackEnv development
  
    &lt;Directory "/Users/&lt;my_user_name&gt;/Sites/pjtname.com/users.pjtname.com/public"&gt;
      Order allow,deny
      Allow from all
    &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>In the <code>host</code> file I have:</p>
  
  <pre><code>##
  # Host Database
  #
  # localhost is used to configure the loopback interface
  # when the system is booting.  Do not change this entry.
  ##
  127.0.0.1   localhost
  255.255.255.255 broadcasthost
  ::1             localhost 
  fe80::1%lo0 localhost
  
  # PJTNAME.COM SETTING
  
  127.0.0.1 pjtname.com
  127.0.0.1 users.pjtname.com
  </code></pre>
  
  <p>All seems to work properly because I have already set everything (I think correctly):</p>
  
  <ul>
  <li>I generated a wildcard certificate for my domains and sub-domains (in this example: *.pjtname.com)</li>
  <li>I have set base-named virtualhosts in the <code>http.conf</code> file listening on port <code>:433</code> and <code>:80</code></li>
  <li>My browser accept certificates also if it alerts me that those aren't safe (<em>notice</em>: I must accept certificates for each domain\sub-domain; that is, [only] at the first time I access a domain or sub-domain over HTTPS I must do the same procedure for acceptance) and I can have access to pages using HTTPS</li>
  </ul>
  
  <p>After all this work, when I make a request using Typhoeus (I can use also the Ruby Net::Http library and the result doesn't change) from the <code>pjtname.com</code> RoR application:</p>
  
  <pre><code># Typhoeus request
  Typhoeus::Request.get("https://users.pjtname.com/")
  </code></pre>
  
  <p>I get something like a warning about the certificate:</p>
  
  <pre><code>--- &amp;id001 !ruby/object:Typhoeus::Response 
  app_connect_time: 0.0
  body: ""
  code: 0
  connect_time: 0.000625
  
  # Here is the warning
  curl_error_message: Peer certificate cannot be authenticated with known CA certificates
  
  curl_return_code: 60
  effective_url: https://users.pjtname.com/
  headers: ""
  http_version: 
  mock: false
  name_lookup_time: 0.000513
  pretransfer_time: 0.0
  request: !ruby/object:Typhoeus::Request 
    after_complete: 
    auth_method: 
    body: 
    ...
  </code></pre>
  
  <p>All this means that something is wrong. So, <strong>what I have to do to avoid the "Peer certificate cannot be authenticated with known CA certificates" warning and make the HTTPS request to work? Where is\are the error\errors</strong> (I think in the Apache configuration, but where?!)<strong>?</strong></p>
  
  <p>P.S.: if you need some more info, let me know.</p>