title: Which certificate chain file to include with self-signed certificate?
body: <p><strong>EDIT :</strong> It may have been preferable to ask this on Server Fault, but my reputation wouldn't let me post more than 2 links. :(</p>
  
  <p>I want some pages that require passwords on my website to be secure, so I followed <a href="http://forum.synology.com/wiki/index.php/How_to_generate_custom_SSL_certificates" rel="noreferrer">this</a> to create a custom SSL certificate. I also followed <a href="http://apetec.com/support/GenerateSAN-CSR.htm" rel="noreferrer">this</a>, because it explains how to generate self-signed multidomain certificates (the <code>subjectAltName</code> allows me to get a valid certificate for example.com and *.example.com, I didn't find another way to do this).<br>
  So I had to mix the commands to get what I wanted, and I think everything is ok with what I did (though I'll detail it later just in case).<br>
  Now I have to configure Apache to listen to queries on port 443 and provide SSL security on the according pages. So I found <a href="https://stackoverflow.com/a/10039017/3288630">this</a>.  </p>
  
  <p>When defining the VirtualHost listening on port 443, it says this :  </p>
  
  <pre><code>&lt;VirtualHost 127.0.0.1:443&gt;
    SSLEngine On  
    SSLCertificateFile /etc/apache2/ssl/something.crt  
    SSLCertificateKeyFile /etc/apache2/ssl/something.key  
    SSLCertificateChainFile /etc/apache2/ssl/gd_bundle.crt  
    ...
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>I think I know what are the files I need to specify for the <code>SSLCertificateFile</code> and <code>SSLCertificateKeyFile</code> fields, but I can't seem to figure out what is the <code>SSLCertificateChainFile</code>. Everything I found by searching on Google and Stack Exchange communities didn't help me so far, so I am asking it clear here :  </p>
  
  <p><strong>What file should I provide for <code>SSLCertificateChainFile</code></strong>, and how do I create it if needed ?  </p>
  
  <hr>
  
  <p>Here are the files that I created by following the instructions of the different links, with the commands I used to create them.  </p>
  
  <ul>
  <li>Certificate authority key (ca.key) : <code>openssl genrsa -des3 -out ca.key 1024</code>  </li>
  <li>Key certificate (ca.san.csr) : <code>openssl req -new -key ca.key -out ca.san.csr -config /etc/ssl/openssl.cnf</code><br>
  Here I specified the config file path because I had to change it a little bit to add the <code>subjectAltName</code>. I could also check that everything went well with <code>openssl req -text -noout -in ca.san.csr</code>. Everything is described <a href="http://apetec.com/support/GenerateSAN-CSR.htm" rel="noreferrer">here</a>.  </li>
  <li>Creation and signature of the certificate (ca.san.crt) : <code>openssl x509 -req -days 3650 -in ca.san.csr -signkey ca.key -out ca.san.crt -extensions v3_req -extfile /etc/ssl/openssl.cnf</code><br>
  Again, the conf file is needed because the <code>subjectAltNames</code> are defined in it.</li>
  <li>Server key (server.key) : <code>openssl genrsa -out server.key 1024</code></li>
  <li>Key certificate (server.san.csr) : <code>openssl req -new -key server.key -out server.san.csr -config /etc/ssl/openssl.cnf</code></li>
  <li>Server certificate (server.san.crt) : <code>openssl x509 -days 3650 -CA ca.san.crt -CAkey ca.key -set_serial 01 -in server.san.csr -req -out server.san.crt</code>  </li>
  </ul>
  
  <hr>
  
  <p>For the <code>SSLCertificateFile</code>, I thought I'd provide the <code>server.san.crt</code> file, this seems to be the most logical thing to me, as well as the <code>server.key</code> file for <code>SSLCertificateKeyFile</code>.<br>
  <code>SSLCertificateChainFile</code> seems to ask for a <code>.crt</code> file, so it may be the only other <code>.crt</code> file that I have, <code>ca.san.crt</code>, but I'm really not sure about this.  </p>
  
  <p><strong>Does anybody have some hint ?</strong><br>
  Thank you for your time reading this.  </p>
  
  <hr>
  
  <p><strong>Solution</strong><br>
  For this particular case, since I am using a custom certificate, <code>SSLCertificateChainFile</code> doesn't make much sense (see the marked answer below). Thus, you just have to specify the same certificate file for both directives, <code>SSLCertificateFile</code> and <code>SSLCertificateChainFile</code>.<br>
  There's just one thing you need to do with Apache before you can use <code>SSL*</code> directives. SSL is disabled by default on Apache so you need to enable it with <code>sudo a2enmod ssl</code>, or when restarting Apache you will get an error saying you may have mispelt something in your vHosts files.<br>
  Once you have done this and restarted the server you may connect on your vHosts with HTTPS. Your browser will tell you that the certificate is not valid because it is self-signed, but your connection will be secure.</p>