Without seeing all of your httpd.conf and conf.d/ssl.conf, it’s hard to say, but if you’re only serving one domain, you should really only have one certificate/key pair. I’d probably either (1) remove your edits from httpd.conf, and make your changes to ssl.conf instead; or (2) remove ssl.conf, and have all your SSL-related directives in httpd.conf.
As to Q2, there are a number of possible reasons, depending on your browser, what else is on the page, and other factors. What do you see if you click on the lock symbol? If you’re using Chrome, then click on the Connection tab in the pop-up, and it should give you the reason for the gray symbol. One reason I see it on one of my pages is if the https page loads some content via http instead.
Where does that ../conf.d/ssl.conf come from? Was it always there? How and where is it included from your httpd.conf? (For example, my Apache configuration doesn’t have a /conf.d/. How does yours fit in?)
What is the contents of that certificate? You can check with: openssl x509 -noout -text </etc/pki/tls/certs/localhost.crt
a) my install of fedora 21, httpd seems to have provided that file.
i think the localhost.crt may be a dummy provided in httpd pkg.
the tree looks like, …
tree /etc/httpd
[sudo] password for jackc:
/etc/httpd
├── conf
│ ├── httpd.conf
│ ├── httpd.conf.orig
│ └── magic
├── conf.d
│ ├── autoindex.conf
│ ├── README
│ ├── ssl.conf
│ ├── ssl.conf.orig
│ ├── ssl.conf.rpmsave
│ ├── userdir.conf
│ └── welcome.conf
├── conf.modules.d
│ ├── 00-base.conf
│ ├── 00-dav.conf
│ ├── 00-lua.conf
│ ├── 00-mpm.conf
│ ├── 00-optional.conf
│ ├── 00-proxy.conf
│ ├── 00-ssl.conf
│ ├── 00-systemd.conf
│ ├── 01-cgi.conf
│ └── README
├── logs -> …/…/var/log/httpd
├── modules -> …/…/usr/lib64/httpd/modules
└── run -> /run/httpd
you can see where i keep .orig’s of the original to track my hacking.
i did create a system.key & system.cert i created locally using fedora doc,
i failed to swap them into the default paths as i wasn’t sure they were ok.
c) slight correction to earlier text, when i connect to https on my server from a remote client shows a green padlock, but connecting to https form the server itself continues w/a gray padlock.
sorry, here is what happens first just clicking the graylock, then also what more info loks like… what additionally useful information am i not providing?
So your concern is because you are seeing a gray padlock in your browser?, well as far as I can see, you are using a dark theme in your firefox and this theme is changing the color of the padlock. Switch to default theme and you will see a green padlock.
Off Topic: I don’t know what is the theme that you are using but if you are using FT Deep Dark, today I talked with the theme developer and he has released a new beta to include a green padlock (the beta verson of the theme only works on firefox beta 44.*).
