up vote 1 down vote favorite
1
share [g+] share [fb]

I've been setting up SSL for my domain today, and have struck another issue - I was hoping someone could shed some light on..

I keep receiving the following error messages:

[error] Init: Unable to read server certificate from file /etc/apache2/domain.com.ssl/domain.com.crt/domain.com.crt
[error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

I'm running Apache 2.2.16 and Ubuntu 10.10. My .crt file has the Begin and End tags, and has been copied exactly from the confirmation email I received, very frustrating!

Cheers!

Edit >> When trying to verify the .crt It doesn't seem to work:

>> openssl x509 -noout -text -in domain.com.crt 
unable to load certificate
16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

Also >>

>> openssl x509 -text -inform PEM -in domain.com.crt
unable to load certificate
21321:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

>> openssl x509 -text -inform DER -in domain.com.crt
unable to load certificate
21325:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1316:
21325:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:380:Type=X509

Edit>> (Cheers for the help by the way)

>> grep '^-----' domain.com.crt
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

Just emailed the company providing the Certificate, they responded>

I have checked the CSR file that you have provided and I can assure that this was correctly generated. The error that you are currently encountering is caused because you are using a wrong command line for installing the CSR. You will need to modify this domain.com.crt from your command line with the according name of your domain.

  • currently the crt is set up to mysite.com.crt - I've used domain.com.crt as an example
link|improve this question
59% accept rate
Could you please show us the output of grep '^-----' domain.com.crt? – quanta Sep 30 '11 at 9:23
Williamsowen, the whole point of a certificate is to be shown to anyone who connects to your webserver; it's not a private thing. That given, would you consider attaching or posting the whole certificate here so we can look directly at it instead of having to guess? – MadHatter Sep 30 '11 at 11:30
Hang on, I see you've just accepted my answer. Does that mean that it was terminal Windows linefeeds that were causing the problem? – MadHatter Sep 30 '11 at 11:31
MadHatter - apologies! New to this, but I've just got it working, the formatting from the email I receieved was off, couldn't thank you guys enough! – williamsowen Sep 30 '11 at 11:33
feedback

3 Answers

up vote 4 down vote accepted

Is it possible that the lines are ^M-terminated? This is a potential issue when moving files from Windows to UNIX systems. One easy way to check is to use vi in "show me the binary" mode, with vi -b /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt.

If each line ends with a control-M, like this

-----BEGIN CERTIFICATE-----^M
MIIDITCCAoqgAwIBAgIQL9+89q6RUm0PmqPfQDQ+mjANBgkqhkiG9w0BAQUFADBM^M
MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg^M
THRkLjEWMBQGA1UEAxMNVGhhd3RlIFNHQyBDQTAeFw0wOTEyMTgwMDAwMDBaFw0x^M

you've got a file in Windows line-terminated format, and apache doesn't love those.

Your options include moving the file over again, taking more care; or using the dos2unix command to strip those out; you can also remove them inside vi, if you're careful.

link|improve this answer
feedback
up vote 1 down vote

Make sure your file has no trailing or leading spaces within the certificate file. Carefully ensure there are no spaces or blanks within your certificate file, by selecting the entire text and looking for blank spaces on a text only editor.

Also check if indeed all the configured files exist and are correct.

Eg: on your other post you say that your .key file is named *my*domain.com.crt while on the vhost configuration you have domain.com.crt

SSLCertificateFile /etc/apache2/domain.ssl/domain.ssl.crt/domain.com.crt
SSLCertificateKeyFile /etc/apache2/domain.ssl/domain.ssl.key/domain.com.key
SSLCertificateChainFile /etc/apache2/domain.ssl/ca.crt
SSLCACertificateFile /etc/apache2/domain.ssl/gs_intermediate_ca.crt

Check again that all the above files really exist and are valid.

link|improve this answer
1  
Also check that your dashes are dashes. Microsoftian text editors like to change -- into –; that was not a lot of fun to troubleshoot. – Shane Madden Sep 29 '11 at 17:10
yeap, since you're on Ubuntu, just open up a terminal and use nano for example. This way you'll be sure. – George Tasioulis Sep 29 '11 at 17:16
Hi, thanks for your feed back - I've checked everything and all is good. I've tried to verify the crt file however I get: sudo openssl x509 -noout -text -in domain.com.crt unable to load certificate 16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE – williamsowen Sep 29 '11 at 21:23
Does the first line of your domain.com.crt file begin with -----BEGIN CERTIFICATE----- and the last line ends with -----END CERTIFICATE-----? – George Tasioulis Sep 29 '11 at 21:34
feedback
up vote 1 down vote 
>> openssl x509 -noout -text -in domain.com.crt 
unable to load certificate
16851:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: TRUSTED CERTIFICATE

I suspect that you have a problem with the format of the certificate.

Run both of two following commands and give us the output:

openssl x509 -text -inform DER -in domain.com.crt 
openssl x509 -text -inform PEM -in domain.com.crt
link|improve this answer
Thanks for this answer. I was able to determine the format my SAs provided as ".cer" were already ".pem" incognito – javafueled Apr 5 at 15:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.