help needed to setup ssl in ubuntu lucid server

Question

I am provided .csr , .key and .crt file to setup ssl in Ubuntu Lucid Server, but i am having troubles setting it up. Can anyone help me set it up and make it working for my server ?

I tried it by searching in web many times but i failed on setting it up. I have setup Virtual Host and works all fine but when i enable the ssl configuration for the site it also works fine. but when i try to restart/reload the server then I get following error:

[Sat Sep 10 01:11:04 2011] [notice] caught SIGTERM, shutting down
[Sat Sep 10 01:11:05 2011] [error] Unable to configure RSA server private key
[Sat Sep 10 01:11:05 2011] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

and sometimes i see "dummy connection" error too

I hope i can get quick helps as i need to do it asap. :)

Thanks...

Answer 1

Try running:

openssl x509 -noout -text -in certfile 

and:

openssl rsa -noout -text -in keyfile

the "modulus" and "public exponent" in keyfile and certfile have to be exactly the same. If they don't, you are likely using an incorrect public keyfile or certificate. Make sure you aren't using the default .key file.

EDIT: Replace certfile with your .crt and keyfile are replaced with the .key file. When you type the above two commands in the terminal, check and see if modulus and public exponent match exactly. If they don't, then that alludes to an accidental overwrite of the .key file. A common cause for losing your .key file is if you first create your certificate request normally, and before you install your new certificate, you may have created a self-signed cert/key pair, which will create a new key, overwriting the previous key. Regardless of the cause or perpetrator, you'll likely need to start over with a new certificate request if you can't get the matching .key file. Most certificate issuers are patient when it comes to these mistakes and will give you a try or two to get it right, so don't sweat it if you have to re-submit your request to them.

If you aren't sure how to generate a request, follow the steps here: http://www.tc.umn.edu/~brams006/selfsign.html