Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running an Ubuntu 10.04 LTS server that has been running Apache2 with a self signed certificate up until now. I finally purchased a real certificate but I can't manage to install it. I received three files from the provider:


Currently in my sites-enabled/ssl I have this for my self signed certificate:

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/cert.pem

So I googled how to convert crt files to pem and it just looks to be a concatination of all the crt files. This is the guide I found that mostly matched what I'm using (I am using namecheap for my DNS now). So I created my new pem file, and pointed my config at it. When I run

service apache2 restart

the daemon fails to start. I figured that I must have put the crts in the wrong order, but it still fails to start. What am I doing wrong? How can I use my new certificate?

As for Key files, I generated one called server.key (which was used to create my csr). It now resides in /etc/apache2/server.key

When starting apache I get these errors:

[Sat Mar 17 13:44:43 2012] [warn] RSA server certificate is a CA certificate  (BasicConstraints: CA == TRUE !?)
[Sat Mar 17 13:44:43 2012] [warn] RSA server certificate CommonName (CN) `PositiveSSL CA 2' does NOT match server name!?
[Sat Mar 17 13:44:43 2012] [error] Unable to configure RSA server private key
[Sat Mar 17 13:44:43 2012] [error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
share|improve this question
What error do you receive from the service command and from /var/log/apache2/error_log? – Kyle Smith Mar 17 '12 at 20:37
Most likely your crt files are DER, not PEM. Did you look at them? Do they look like PEM? Also, you may be confusing your certificate with the chain certificate. You really should look closely at the certificate files. You can use openssl x509 -text ... to dump the certificate. – David Schwartz Mar 17 '12 at 22:16
up vote 4 down vote accepted

Can you provide information on how you generated the certificate?

You're missing the private key (probably a .key file) which was used to generate the .csr file that you sent to the certificate authority. That specific private key is required for Apache to be able to use the public key that you were given.


With that key file, you'll need something like this added to your config:

SSLCertificateKeyFile /etc/apache2/server.key

Make sure that file is set to a permission mode where it's not viewable to everything on the server - mode 600 should be good.

If it won't start after that's added, let me know what errors come up (on the console or in the Apache error log).

With the .crt files that you got concatenated together, your Apache server should be sending full certificate chains properly; you can verify that it's working with openssl s_client -connect localhost:443 -showcerts.

share|improve this answer
Sure, I'll update my question – CountMurphy Mar 17 '12 at 20:27
so that key file goes into the pem? – CountMurphy Mar 17 '12 at 20:36
@CountMurphy Edited my answer. – Shane Madden Mar 17 '12 at 20:38
edited again :) – CountMurphy Mar 17 '12 at 20:46
@CountMurphy Your concatenation didn't work right. Start out with just pointing SSLCertificateFile at the mynewdomain_com.crt file. – Shane Madden Mar 17 '12 at 21:34

RSA server certificate is a CA certificate means thay you've specified you CA's cert as certificate file, not yours (which was signed by CA).

You may want to try to replace path to SSLCertificateFile to crt that was signed by CA, not CA cert itself.

Update: A bit more detailed explanation:

You should have 3 files:

  1. Secret key (usually something with .key extension). This is the most important one. You should keep it secret and never ever send to anyone. This file is actually used to encrypt data. You should specify path to this file in SSLCertificateKeyFile directive.

  2. Certificate of your CA. This is public certificate of ceritficate authority that you've used to sign your public key. You should specify path to this file in SSLCACertificateFile directive.

  3. Signed public key. This is public part of your key which you've extracted from key file (in form of certificate request) and send to CA for signing. You should specify path to this file in SSLCertificateFile directive.

share|improve this answer
Seems to be some shuffling in the directive names. – Shane Madden Mar 17 '12 at 22:55
oh, sorry, fixed – rvs Mar 18 '12 at 7:36

I never requested a certificate from a "real" CA, in my tests I also created the CA.

But then, in apache2 config I also configured in which path is the CA cert, you may check that, just in case.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.