Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to implement Stud as an SSL termination point before HAProxy as a proof of concept for WebSockets routing. My domain registrar offers free 1-year SSL certs.

Through OpenSSL, I generated a CSR which gave me two files:

  1. domain.key
  2. domain.csr

I gave domain.csr to my trusted authority and they gave me two files:

  1. domain.cert
  2. GandiStandardSSLCA.pem (I think this is referred to as the intermediary cert?)

This is where I encountered friction: Stud, which uses OpenSSL, expects there to be an "rsa private key" in the "pem-file" - which it describes as "SSL x509 certificate file. REQUIRED."

If I add the domain.key to the bottom of Stud's pem-file, Stud will start but I receive the browser warning saying "The certificate is self-signed." If I omit the domain.key Stud will not start and throws an error triggered by an OpenSSL function that appears intended to determine whether or not my "pem-file" contains an "RSA Private Key".

At this point I cannot determine whether the problem is:

  1. Free SSL cert will always be self-signed and will always cause browser to present warning
  2. I'm just not using Stud correctly
  3. I'm using the wrong "RSA private key"
  4. The CA domain cert, the intermediary cert, and the private key are in the wrong order.
share|improve this question
up vote 1 down vote accepted

SSL X509 certificate file is a file containing a certificate in the format specified by the ITU in their X series of specifications - specifically x.509. There is no private-key information there as it is a certificate format so things like names, public keys, signatures, validity dates and other goodies go in there - but not private-keys.

PEM is a set of specifications for Privacy Enhanced Mail - it offers for the most part packaging standards that are build off of the PKCS specs (PKCS specs were developed by RSA and RSA labs themselves for public use to enable interoperability between various implementations - this was done again by the IETF and by the community in other arenas). You can use openssl to convert formats around - see here . Concatenation won't help you any.

If the certificate is self-signed then it's kind of odd that a CA gave it to you - that makes me think that you are telling about feeding the Gandi CA certificate to openssl which is telling you that cert is self signed (ergo it is a root or end entity certificate but certainly not an intermediate aka chain certificate).

To address some of your points: 1 Self signed certs will always generate warnings in good clients because they lack trust until the user decides they are trustworthy (or for most users.. until Microsoft , Mozilla Foundation, Google, or Opera) decides the user should trust that CA). If your clients (browsers or whatever) have the CA stored and marked as trusted then this warning won't pop-up. 2 Possibly 3 Looks like you used the right key and CSR with Gandi 4 Looks to me like you need to load the domain key and cert and possibly CA into OpenSSL either via OS level trust configuration or via Stud configuration.

share|improve this answer
Thanks @Ram. I ended up having to concatenate the domain cert from, the chain certificate from, and finally, the RSA Private Key that I created with my CSR into one file (in that order) - this file was pointed to in Stud's pem-file setting. The problem I was actually having, as bone-headed as it was, was that I failed to realize that Stud was using port 8443 and that Apache was, by default, using port 443. As such, all my https requests were being handled directly by Apache (hence the self-signed generic cert). Completely embarrassing. Thank you again. – Aaron Jun 21 '12 at 23:10
really because it doesn't seem to matter what order I put them in it always does the same thing. – user135915 Sep 14 '12 at 7:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.