Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone see where I went wrong on these steps (on Windows XP + Apache 2.2)?

I tried to create my own self signed SSL certificate with my own CA and when its all done my Apache server wont start and my log file says:

[info] Init: Seeding PRNG with 136 bytes of entropy
[info] Loading certificate & private key of SSL-aware server
[error] Init: Unable to read server certificate from file C:/Apache2.2/conf/thor.mysite.com_cert/ksb_cert_rep.p12
[error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[error] SSL Library Error: 218640442 error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error

Here is what I did to create the cert:

openssl req -x509 -out ca_cert.pem -newkey rsa:2048 -keyout ca_priv_key.pem -days 3650
openssl x509 -in ca_cert.pem -text -noout
openssl req -out ksb_cert_req.pem -new -keyout ksb_priv_key.pem
openssl req -noout -text -verify -in ksb_cert_req.pem
openssl x509 -req -in ksb_cert_req.pem -CA ca_cert.pem -CAkey ca_priv_key.pem -CAcreateserial -out ksb_cert_rep.pem -days 3650
openssl pkcs12 -export -in ksb_cert_rep.pem -inkey ksb_priv_key.pem -out ksb_cert_rep.p12 -name "ksb certificate"
openssl pkcs12 -info -in ksb_cert_rep.p12
openssl rsa -in ksb_priv_key.pem -out ksb_priv_key_nopass.pem

Also, here is the config in my Apache httpd-ssl.conf file:

SSLCertificateFile "C:/Apache2.2/conf/ksb_cert_rep.p12"
SSLCertificateKeyFile "C:/Apache2.2/conf/ksb_priv_key_nopass.pem"
share|improve this question
up vote 1 down vote accepted

Apache doesn't like PKCS12 format certificates, it expects x509. Use your ksb_cert_rep.pem file, instead.

share|improve this answer
Thanks. I can't believe I didn't notice that. – djangofan Dec 8 '11 at 21:44
I also suspect what while its true that on Windows , Apache expects x509, on linux, this is not the case? – djangofan Dec 27 '11 at 17:31
@djangofan What makes you think that? – Shane Madden Dec 27 '11 at 17:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.