Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When trying to install a SSL key on my centos server, apache refuses to restart and I see the following errors in my log.

[Tue Mar 16 22:32:58 2010] [error] Init: Private key not found
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

What exactly does this mean? Is my SSL key bad? If so, what is the correct way to upload the key to the server? I just opened the crt file in notepad and copied the data out and saved it over ssh.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Check

SSLCertificateFile and

SSLCertificateKeyFile

in /etc/http/conf/httpd.conf are both pointing at the correct files.

Check that the SSLCertificateKeyFile is a key with ownership set to root:root and permissions set to 400.

Sounds like you have the .crt in place but not the .key.

See the Apache SSL FAQ for more details.

share|improve this answer
    
Also, keep in mind that the default SSL key/cert that CentOS attempts to load is usually defined in /etc/httpd/conf.d/ssl.conf, and can confuse things. (I always disable the default certificate). –  Joe Mar 16 '10 at 23:16
    
Richard, I checked both the ownership and the permissions and they seem to be good. Apache still won't start up and I'm getting the same errors. –  mike Mar 16 '10 at 23:19
    
Joe, How do I disable the default cert in ssl.conf? –  mike Mar 16 '10 at 23:20
    
Yummm , Can I just check you have a key file that is in the correct location defined by SSLCertificateKeyFile and that it is the key for the crt file defined by SSLCertificateFile. –  Richard Holloway Mar 16 '10 at 23:37
    
Richard, Take a look at the original post. I added my httpd.conf settings. –  mike Mar 16 '10 at 23:41
show 3 more comments

Instal Apache mod ssl

# yum install mod_ssl

Go to certs folder in centos 6

# cd /etc/ssl/certs/

Regenerate Private Key and CSR with the help of following OpenSSL command

# openssl req -nodes -newkey rsa:2048 -keyout namhuy_net.key -out namhuy_net.csr

Get the CA Root Certificate from Verisign, Thawte, Globalsign, Comodo. After you purchase a cert from those vendor, you will get an email w/ cert files. Upload those files to

/etc/ssl/certs/

Save the combined file as namhuy_net.pem. The .pem file is now ready to use.

The SSL configuration file for Apache is where I ended up putting the configurations for my server.

# nano /etc/httpd/conf.d/ssl.conf

Edit lines

SSLEngine on
SSLCertificateFile /etc/ssl/certs/namhuy_net.crt
SSLCertificateKeyFile /etc/ssl/certs/namhuy_net.key
SSLCertificateChainFile /etc/ssl/certs/namhuy_net.pem

Restart httpd service

# service httpd restart

Source: http://namhuy.net/760/how-to-install-an-ssl-certificate-on-centos-for-apache.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.