Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create self signed certificate for the website. The old certificate expired few days ago. There are more than one NameVirtualHosts hosted on systems. The commands I am using to create certificate are taken from one tutorial website and are:

openssl genrsa -des3 -out server.key 1024
openssl req -new -key server.key -out server.csr 
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

After this in ssl.conf file I have specified under VirtualHost section along with old settings done by other admin

SSLEngine on
SSLCertificateFile <full_path>/server.crt
SSLCertificateKeyFile <full_path>/server.key

On starting the server I am getting following messages in log file and server fails to start.

In error_log file messages are

 [Mon Jun 01 23:52:46 2009] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

In ssl_error_log file messages are

 [Mon Jun 01 23:52:46 2009] [error] Init: Private key not found
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
 [Mon Jun 01 23:52:46 2009] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

I would really appreciate if some one can explain how to solve this. I have tried a few other tutorial website on self signed SSL certificates but none of the steps they mention are working.

share|improve this question
add comment

3 Answers

up vote 18 down vote accepted

Use this one liner to generate the certificate and key in one file

openssl req -new -x509 -days 999 -nodes -out apache.pem -keyout apache.pem

Then the only configuration you'll need is

SSLEngine on
SSLCertificateFile /etc/apache2/apache.pem
share|improve this answer
    
you mean add above line sslengine on and sslcertificatefile /etc/ssh –  Rajat Jul 14 '10 at 17:55
    
this is for apache configuration, not ssh. –  hayalci Jul 27 '10 at 10:39
    
That command will leave the private key in the clear on the file system, in contrast to the OP's original command. Omitting the -nodes option encrypt the key using Triple-DES. (The key's passphrase will of course need to be provided whenever the server is started.) The OpenSSL req command doesn't support generating more strongly-encrypted keys, but can use previously generated strongly-encrypted keys. –  Calrion Jan 29 at 0:48
add comment

This may seem a bit trivial, but check the permission on your .key file

share|improve this answer
    
+1 Sometimes the trivial things are the least thought of. –  Burkhard Jun 1 '09 at 19:48
add comment

You can use openssl req -newkey rsa:1024 -keyout privkey.pem to save off the SSL key as it's generated, in case the key generation isn't quite right.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.