Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have got a nic signed certificate which I am trying to configure in my apache server without much luck :(. For this certificate to be generated, they needed CSR from my side. I created CSR using the following commands:

Created keystore file first using command -

keytool -genkey -alias generated -keyalg RSA -keysize 2048 -keystore generated.keystore

Generated CSR from this keystore using following command:

keytool -certreq -keyalg RSA -alias generated -file generated.csr -keystore generated.keystore

My csr looked like:


They have generated a certificate (.cer) file for this, which looks like:


Apache configuration in ssl.conf file:

SSLCertificateFile /etc/pki/tls/certs/signed.cer
SSLCertificateKeyFile /etc/pki/tls/private/generated.keystore

Now when I start my apache I get an error saying:

[Tue Jan 24 13:10:38 2012] [error] Init: Private key not found
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Tue Jan 24 13:10:38 2012] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

Does anyone know what is the issue?

share|improve this question
Is your SSl certificate key is authenticated? – user109367 Feb 6 '12 at 11:26
up vote 5 down vote accepted

You need to convert the private key from the Java keystore format to the PEM format used by OpenSSL. With the keytool version from JDK >= 1.6 you can do it by first converting the keystore to the PKCS#12 format, and then extracting just the private key:

keytool -importkeystore -srckeystore generated.keystore -destkeystore generated.p12 -deststoretype PKCS12
openssl pkcs12 -in generated.p12 -out generated.pem -nocerts

This writes the private key file to generated.pem; then specify this file in the Apache configuration:

SSLCertificateKeyFile /etc/pki/tls/private/generated.pem

Because the private key file is by default encrypted with a password, every time you start Apache you will need to enter this password. You can either use the SSLPassPhraseDialog to provide the password automatically, or just add the -nodes option to the openssl pkcs12 command to produce an unencrypted private key file.

share|improve this answer
Thanks a lot! You saved my day! :) – Ankit Jan 24 '12 at 9:27
One more thing, I wanted to test my certificate validity before Go-Live. What I have done is made an entry in my hosts file for the domain name with apache web server ip address which has this valid ca signed certificate and now I am hitting my application on browser using the domain name that I have. Is this correct way to test it, or is there any other way available? – Ankit Jan 24 '12 at 9:45
I have been able to test the SSL certificate successfully, I had to install the chain certificates as well, which i missed. Now IE browser is showing me secure sign, but still firefox is saying that the certificate is invalid. Some (Error code: sec_error_unknown_issuer) error is there. I imported the chain certificate in webserver using keytool –importcert –alias nicchain –file chain.cer –keystore ../jre/lib/security/cacerts –storepass changeit command and also Made an entry in ssl.conf for SSLCertificateChainFile /etc/pki/tls/certs/chain.cer – Ankit Jan 24 '12 at 10:52
The problem is that the “CCA India 2011” root certificate is included in Windows Root CA list, but not yet included in Mozilla's list (see #511380 and #557167, but that is for “CCA India 2007”, and the new 2011 cert with the SHA256 hash is not mentioned at all). Therefore all certs signed by the “CCA India 2011” root will not be trusted in Mozilla products, unless the root certificate is installed manually. – Sergey Vlasov Jan 25 '12 at 9:40
Thanks a lot for you kind help. – Ankit Jan 25 '12 at 13:16

You need to point SSLCertificateKeyFile to a private key, not a keystore.

share|improve this answer

Instal Apache mod ssl

# yum install mod_ssl

Go to certs folder in centos 6

# cd /etc/ssl/certs/

Regenerate Private Key and CSR with the help of following OpenSSL command

# openssl req -nodes -newkey rsa:2048 -keyout namhuy_net.key -out namhuy_net.csr

Get the CA Root Certificate from Verisign, Thawte, Globalsign, Comodo. After you purchase a cert from those vendor, you will get an email w/ cert files. Upload those files to


Save the combined file as namhuy_net.pem. The .pem file is now ready to use.

The SSL configuration file for Apache is where I ended up putting the configurations for my server.

# nano /etc/httpd/conf.d/ssl.conf

Edit lines

SSLEngine on
SSLCertificateFile /etc/ssl/certs/namhuy_net.crt
SSLCertificateKeyFile /etc/ssl/certs/namhuy_net.key
SSLCertificateChainFile /etc/ssl/certs/namhuy_net.pem

Restart httpd service

# service httpd restart


share|improve this answer
Easy on the copy-n-paste job... Your answers should be relevant to the question your posting them to, most of this "answer" doesn't apply to this question. – Chris S Dec 21 '13 at 5:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.