title: Apache httpd - OCSP-Stapling - ssl:error AH02217
body: <h2>Introduction</h2>
  
  <p>I want to configure <a href="https://wiki.apache.org/httpd/OCSPStapling" rel="nofollow">OCSP Stapling</a> for my <code>httpd</code> service, which is running in this version:</p>
  
  <pre><code>[root@localhost ~]# httpd -v
  Server version: Apache/2.4.6 (CentOS)
  Server built:   Nov 19 2015 21:43:13
  </code></pre>
  
  <p>I am running this Linux distribution:</p>
  
  <pre><code>[root@localhost ~]# lsb_release -a
  LSB Version:    :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch
  Distributor ID: CentOS
  Description:    CentOS Linux release 7.2.1511 (Core)
  Release:        7.2.1511
  Codename:       Core
  </code></pre>
  
  <h2>Approach</h2>
  
  <p>From what I understood by reading the <a href="https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html" rel="nofollow">official Apache ssl HowTo</a> and the <a href="https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatefile" rel="nofollow">official Apache ssl Doc</a> is: On the one hand I have to edit the file <code>/etc/httpd/conf/httpd.conf</code>, and on the other I have to specify and copy a <code>.pem</code> file. A similar approach is given by a <a href="https://support.globalsign.com/customer/portal/articles/1642333-apache---enable-ocsp-stapling" rel="nofollow">Tutorial found here</a>. </p>
  
  <h2>Problem implementing Approach</h2>
  
  <p>As a matter of fact my file <code>/etc/httpd/conf/httpd.conf</code> contains several <code>VirtualHosts</code> and looks like this (comments and some other things are omited):</p>
  
  <pre><code>[root@localhost ~]# cat /etc/httpd/conf/httpd.conf
  ServerRoot "/etc/httpd"
  Listen 8443
  ServerName my.main.domain.com
  LoadModule  proxy_module         modules/mod_proxy.so
  LoadModule  proxy_http_module    modules/mod_proxy_http.so
  LoadModule  headers_module       modules/mod_headers.so
  LoadModule  deflate_module       modules/mod_deflate.so
  LoadFile    /usr/lib64/libxml2.so.2
  LoadModule  xml2enc_module       modules/mod_xml2enc.so
  LoadModule  proxy_html_module    modules/mod_proxy_html.so
  LoadModule  ssl_module           /usr/lib64/httpd/modules/mod_ssl.so
  Include conf.modules.d/*.conf
  SSLUseStapling On
  SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
  #commenting this in leads to the errors `AH02217`, `AH02235`,`AH01895` and `AH02312` from which httpd refused to restart
  #SSLCACertificateFile /etc/httpd/conf/myFile.pem
  &lt;VirtualHost *:8443&gt;
      ProxyPreserveHost On
      ProxyRequests Off
      ServerName sub1.my.main.domain.com
      RewriteEngine On
      ProxyVia Off
      ProxyPass / http://127.0.0.1:8887/
      ProxyPassReverse / http://127.0.0.1:8887/
      RequestHeader add X-Forwarded-Ssl on
      RequestHeader set X-Forwarded-Proto "https"
      &lt;Proxy *&gt;
          Order deny,allow
          Allow from all
      &lt;/Proxy&gt;
      SSLEngine On
      SSLCertificateFile /etc/httpd/conf/someOtherFile.cer
      SSLCertificateKeyFile /etc/httpd/conf/someOtherFile.key
      #commenting this in here also leads to the errors `AH02217`, `AH02235`,`AH01895` and `AH02312` from which httpd refused to restart
      #SSLCACertificateFile /etc/httpd/conf/myFile.pem
  &lt;/VirtualHost&gt;
  # more VirtualHost directives
  </code></pre>
  
  <p>This is the content of the error log file <code>/etc/httpd/logs/error_log</code>:</p>
  
  <pre><code>[Wed Apr 06 11:23:01.702030 2016] [ssl:error] [pid 19305] AH02217: ssl_stapling_init_cert: Can't retrieve issuer certificate!
  [Wed Apr 06 11:23:01.702050 2016] [ssl:error] [pid 19305] AH02235: Unable to configure server certificate for stapling
  [Wed Apr 06 11:23:01.702639 2016] [ssl:emerg] [pid 19305] AH01895: Unable to configure verify locations for client authentication
  [Wed Apr 06 11:23:01.702650 2016] [ssl:emerg] [pid 19305] AH02312: Fatal error initialising mod_ssl, exiting.
  </code></pre>
  
  <p>I have produced the file <code>myFile.pem</code> from a <code>anotherFile.pfx</code> using <code>openssl</code> in the following fashion:</p>
  
  <pre><code>[root@localhost ~]# openssl pkcs12 -in anotherFile.pfx -nocerts -out myFile.pem
  Enter Import Password:
  MAC verified OK
  </code></pre>
  
  <h2>Questions</h2>
  
  <ol>
  <li>What is wrong with my config?</li>
  <li>Did I do something wrong when converting the <code>.pfx</code> file to the <code>.pem</code> file?</li>
  <li>Which information do I need from my certificate providers to correctly convert the <code>.pfx</code> file to the <code>.pem</code> file?</li>
  <li>Is my description lacking information crucial to debug this problem?</li>
  </ol>