Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When trying to install a SSL key on my centos server, apache refuses to restart and I see the following errors in my log.

[Tue Mar 16 22:32:58 2010] [error] Init: Private key not found
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Tue Mar 16 22:32:58 2010] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

What exactly does this mean? Is my SSL key bad? If so, what is the correct way to upload the key to the server? I just opened the crt file in notepad and copied the data out and saved it over ssh.

share|improve this question
up vote 4 down vote accepted


SSLCertificateFile and


in /etc/http/conf/httpd.conf are both pointing at the correct files.

Check that the SSLCertificateKeyFile is a key with ownership set to root:root and permissions set to 400.

Sounds like you have the .crt in place but not the .key.

See the Apache SSL FAQ for more details.

share|improve this answer
Also, keep in mind that the default SSL key/cert that CentOS attempts to load is usually defined in /etc/httpd/conf.d/ssl.conf, and can confuse things. (I always disable the default certificate). – Joe Mar 16 '10 at 23:16
Richard, I checked both the ownership and the permissions and they seem to be good. Apache still won't start up and I'm getting the same errors. – mike Mar 16 '10 at 23:19
Joe, How do I disable the default cert in ssl.conf? – mike Mar 16 '10 at 23:20
Yummm , Can I just check you have a key file that is in the correct location defined by SSLCertificateKeyFile and that it is the key for the crt file defined by SSLCertificateFile. – Richard Holloway Mar 16 '10 at 23:37
Richard, Take a look at the original post. I added my httpd.conf settings. – mike Mar 16 '10 at 23:41

Instal Apache mod ssl

# yum install mod_ssl

Go to certs folder in centos 6

# cd /etc/ssl/certs/

Regenerate Private Key and CSR with the help of following OpenSSL command

# openssl req -nodes -newkey rsa:2048 -keyout namhuy_net.key -out namhuy_net.csr

Get the CA Root Certificate from Verisign, Thawte, Globalsign, Comodo. After you purchase a cert from those vendor, you will get an email w/ cert files. Upload those files to


Save the combined file as namhuy_net.pem. The .pem file is now ready to use.

The SSL configuration file for Apache is where I ended up putting the configurations for my server.

# nano /etc/httpd/conf.d/ssl.conf

Edit lines

SSLEngine on
SSLCertificateFile /etc/ssl/certs/namhuy_net.crt
SSLCertificateKeyFile /etc/ssl/certs/namhuy_net.key
SSLCertificateChainFile /etc/ssl/certs/namhuy_net.pem

Restart httpd service

# service httpd restart


share|improve this answer

SOLVED in REDHAT and Centos Check yoyr Selinux disable it then tray restart httpd it will start without ssl cert missing error.

share|improve this answer
Firstly, this question already has an accepted answer. Secondly, your solution is not good - disabling Selinux is not a solution - at best it is a poor workaround! – BE77Y Jun 10 at 8:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.