Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on..

I keep receiving the following error messages:

[error] Init: Unable to read server certificate from file /etc/apache2/
[error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

I'm running Apache 2.2.16 and Ubuntu 10.10. My .crt file has the Begin and End tags, and has been copied exactly from the confirmation email I received, very frustrating!


Edit >> When trying to verify the .crt It doesn't seem to work:

>> openssl x509 -noout -text -in 
unable to load certificate
16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

Also >>

>> openssl x509 -text -inform PEM -in
unable to load certificate
21321:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE
>> openssl x509 -text -inform DER -in
unable to load certificate
21325:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1316:
21325:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:380:Type=X509

Edit>> (Cheers for the help by the way)

>> grep '^-----'

Just emailed the company providing the Certificate, they responded>

I have checked the CSR file that you have provided and I can assure that this was correctly generated. The error that you are currently encountering is caused because you are using a wrong command line for installing the CSR. You will need to modify this from your command line with the according name of your domain.

  • currently the crt is set up to - I've used as an example
share|improve this question
Could you please show us the output of grep '^-----' – quanta Sep 30 '11 at 9:23
Williamsowen, the whole point of a certificate is to be shown to anyone who connects to your webserver; it's not a private thing. That given, would you consider attaching or posting the whole certificate here so we can look directly at it instead of having to guess? – MadHatter Sep 30 '11 at 11:30
Hang on, I see you've just accepted my answer. Does that mean that it was terminal Windows linefeeds that were causing the problem? – MadHatter Sep 30 '11 at 11:31
MadHatter - apologies! New to this, but I've just got it working, the formatting from the email I receieved was off, couldn't thank you guys enough! – williamsowen Sep 30 '11 at 11:33

10 Answers 10

up vote 29 down vote accepted

Is it possible that the lines are ^M-terminated? This is a potential issue when moving files from Windows to UNIX systems. One easy way to check is to use vi in "show me the binary" mode, with vi -b /etc/apache2/domain.ssl/domain.ssl.crt/

If each line ends with a control-M, like this


you've got a file in Windows line-terminated format, and apache doesn't love those.

Your options include moving the file over again, taking more care; or using the dos2unix command to strip those out; you can also remove them inside vi, if you're careful.

share|improve this answer
For me it was a copy&paste error, omitting the first couple of characters of the header -----BE... Thanks for the inspiration to double check! – cfi Nov 3 '12 at 17:31
Thanks, this was my problem! In notepad++ in windows you can use the EDIT-EOL conversion dialog to change set the correct LF format. And you can use the View-Show Symbol menu to actually see the windows CR LF line endings. – Bjørn Nov 17 '13 at 13:04
My certificate simply ended up being an empty file. Something got broke in the generation I guess. This answer encouraged me to open it up and see that. – flickerfly Feb 18 '14 at 19:31
Note to Windows users: You'll probably need to convert the line format to UNIX even if you're on Windows. DOS2UNIX is not a Windows command, but a Linux one. The good news, Git for Windows provides it. CigWin probably does too, but not sure about it. – Ignacio Segura Sep 17 '15 at 8:35
Note to Windows users: a list of permissions in Windows Explorer's Properties / Security tab gets messed up after copying a restricted-permissions file from a network share with Cygwin's cp. E.g., I saw a "NUL SID", a disabled Everyone and domain users entries. – eel ghEEz 2 days ago

For anyone arriving at this page with a similar error when trying to read a Certificate Signing Request (CSR) (note that OP is reading a certificate): make sure to use the right OpenSSL command. x509 is for certificates and req is for CSRs:

openssl req -in server.csr -text -noout


openssl x509 -in server.crt -text -noout
share|improve this answer

In my case, I found my certificate had different "-" characters. Must have been a copy/paste issue from the admin that placed the cert onto the server, with the text editor replacing -- with a special unicode character along the way.

This took hours to diagnose, and in the end I just guessed at it, and edited the cert in vi and deleted the existing "-" characters, and retyped them.

Hope this helps someone.

share|improve this answer

Just went round and round in circles on this, and it turned out I had the certificates around the wrong way - e.g.

SSLCertificateFile    /etc/apache2/ssl/server.key
SSLCertificateKeyFile /etc/apache2/ssl/server.crt

instead of:

SSLCertificateFile    /etc/apache2/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/ssl/server.key

Something to check if you're getting this error.

share|improve this answer
Just did the same mistake, thanks for pointing me to the solution :-) – rcomblen Jan 7 '14 at 7:37

In my case, I encountered the OP's errors because whoever created the .crt file for me in the first place had really created a .PEM formatted file, and named it .crt.

I discovered this by running into the following helpful guide:

all I had to do was rename my .crt to a .pem, and I was done! The guide indicated that the errors from the OP's question imply that the input file is PEM formatted already, so attempting to convert it to .pem from a DER format cannot be done, and is in fact unnecessary.

share|improve this answer
>> openssl x509 -noout -text -in 
unable to load certificate
16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

I suspect that you have a problem with the format of the certificate.

Run both of two following commands and give us the output:

openssl x509 -text -inform DER -in 
openssl x509 -text -inform PEM -in 
share|improve this answer
Thanks for this answer. I was able to determine the format my SAs provided as ".cer" were already ".pem" incognito – javafueled Apr 5 '12 at 15:15

Make sure your file has no trailing or leading spaces within the certificate file. Carefully ensure there are no spaces or blanks within your certificate file, by selecting the entire text and looking for blank spaces on a text only editor.

Also check if indeed all the configured files exist and are correct.

Eg: on your other post you say that your .key file is named *my* while on the vhost configuration you have

SSLCertificateFile /etc/apache2/domain.ssl/domain.ssl.crt/
SSLCertificateKeyFile /etc/apache2/domain.ssl/domain.ssl.key/
SSLCertificateChainFile /etc/apache2/domain.ssl/ca.crt
SSLCACertificateFile /etc/apache2/domain.ssl/gs_intermediate_ca.crt

Check again that all the above files really exist and are valid.

share|improve this answer
Also check that your dashes are dashes. Microsoftian text editors like to change -- into ; that was not a lot of fun to troubleshoot. – Shane Madden Sep 29 '11 at 17:10
yeap, since you're on Ubuntu, just open up a terminal and use nano for example. This way you'll be sure. – George Tasioulis Sep 29 '11 at 17:16
Hi, thanks for your feed back - I've checked everything and all is good. I've tried to verify the crt file however I get: sudo openssl x509 -noout -text -in unable to load certificate 16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE – williamsowen Sep 29 '11 at 21:23
Does the first line of your file begin with -----BEGIN CERTIFICATE----- and the last line ends with -----END CERTIFICATE-----? – George Tasioulis Sep 29 '11 at 21:34

Should someone else run into this problem and your apache error logs say something like:

Init: Unable to read server certificate from file /etc/apache2/

Make sure you haven't swapped your key and certificate files in the declarations in the apache config. I had pointed the key to my certificate file and the certificate to my key file. This post helped me figure out the problem but I wanted to point it out as another potential problem/solution.

share|improve this answer

My problem (having the same error while installing a new server with Apache 2.4) was that Apache (2.4) couldn't read the binary .crt file. I imported it in my personal certificate store (with mmc) and exported it as base-64 encoded X.509 (.cer). Renamed the exported file to the same name (.crt) (used in my httpd-ssl.conf) and it worked again! The same certificate worked on my old server, maybe Apache 2.4 is more stringent then 2.2? Good luck.

share|improve this answer

In my case, it has to do with BOM being present in the file. One could strip it like so:

tail -c +4 ssl.crt > ssl2.crt

Not sure if it always takes 3 bytes, so the better way must be:

vi -c 'se nobomb' -c wq ssl.crt
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.