Heroku SSL: Pem is invalid / Key doesn't match the Pem certificate

Question

I bought a Gandi.net SSL certificate and I'm following this tutorial.

1. I created the key file.
2. then transformed it to CSR
3. then added it to Gandi website and waited for the CRT.
4. then removed the password from the key ===> result : [FINAL KEY]
5. then merged the CRT and the FINAL KEY into one file ==> result : [FINAL PEM]
6. then heroku ssl:add final_pem final_key --app app_name

and... got Pem is invalid / Key doesn't match the Pem certificate.

I tried 3 times and I really don't know what's going one.

Can you help ?

Answer 1

I got my certs from another provider but I kept my public cert and private key in separate files and it worked.

Answer 2

I think I may have run into a similar issue when attempting to use a Gandi certificate on Heroku. Heroku kept on complaining that my PEM file didn't match my key, and running openssl x509 -noout -modulus -in example.com.crt gave me an "unable to load certificate" error.

The issue in my case was very simple: when I downloaded the certificate from Gandi, there was an extra blank line between the certificate text and the "--END CERTIFICATE..." line:

ghjg86GHHJ47Nmmmaiuoj8bUW8bbn/9w78sTxuguHQWjhuhuQWQhuybyyA==

-----END CERTIFICATE-----

When I deleted the blank line, everything worked perfectly:

ghjg86GHHJ47Nmmmaiuoj8bUW8bbn/9w78sTxuguHQWjhuhuQWQhuybyyA==
-----END CERTIFICATE-----

I think when you create the final PEM file that you want to concatenate your certificate and your CA's certificate, not your certificate and your private key:

cat example.com.crt certificate-issuer.com.pem > example.com.pem

Finally, I found http://blog.bloom.io/2011/09/16/https-ssl-table-stakes/ very helpful with the whole process.