Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get SSL to run on my apache web server.

I do not have the DNS for the domain setup yet is that an issue?

How do I setup SSL on my web server?

When I start apache it fails.

root@vannevar:/etc/apache2/ssl# service apache2 start
 * Starting web server apache2                                                                                                                         Action 'start' failed.
The Apache error log may have more information.

The log stats that it's unable to read the certificate.

[Thu Jun 28 15:01:02 2012] [error] Init: Unable to read server certificate from file /etc/apache2/ssl/
[Thu Jun 28 15:01:02 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Thu Jun 28 15:01:02 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

The contents of /etc/apache2/httpd.conf

ServerName [SERVERIP]

The contents of /etc/apache2/ports.conf

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

NameVirtualHost [SERVERIP]:443
NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443

<IfModule mod_gnutls.c>
    Listen 443

The contents of /etc/apache2/sites-available/

<VirtualHost *:80>
     DocumentRoot /srv/sites/
     ErrorLog /srv/sites/
     CustomLog /srv/sites/ combined

<VirtualHost [SERVERIP]:443>
     SSLEngine On
     SSLCertificateFile /etc/apache2/ssl/
     SSLCertificateKeyFile /etc/apache2/ssl/
     SSLCACertificateFile /etc/apache2/ssl/comodo.crt

     DocumentRoot /srv/sites/
     ErrorLog /srv/sites/
     CustomLog /srv/sites/ combined


In dreamhost (which i'm trying to get off of) I already have a domain with ssl / https I can see the three keys in the dreamhost admin certificate, private key, and intermediate certificate. Can I do anything with these? I can see that dreamhost is using comodo and my website says its PositiveSSL so... on comodo's website there is the root certificate and intermediate certificate. What do these five certificates have to do with the two created by the openssl req -new -days 365 -nodes -keyout -out command? These two are requesting the actual certificate?

I realized that apache's error is referring to the file /etc/apache2/sites-available/www.example/com where I messed up the file type for SSLCertificateFile /etc/apache2/ssl/ it's supposed to be .crt according to the linode docs

Update 2

So I went into dreamhost and coppied the keys to the following files and mapped the following

certificate => dh.crt
private key => dh.key
intermediate certificate => dh.cer

changed the connection in /sites-available/ and it worked (apache worked). Does this mean that ssl will work when I connect my domain?

share|improve this question
up vote 2 down vote accepted

I can't vote up on here, or comment, but Adrian Perez is right, you aren't using a certificate but a certificate signing request, on this line:

SSLCertificateFile /etc/apache2/ssl/

The CSR needs to be sent to a certificate authority to verify your identity and generate the certificate. You can self generate this using the command:

openssl x509 -req -days 365 -in -signkey -out

And changing:

SSLCertificateFile /etc/apache2/ssl/


SSLCertificateFile /etc/apache2/ssl/

But then you'll get warnings when you visit the site in your browser, as this would be a self signed certificate and therefore not trusted. Still, it's a good way to get your head around the process and test that the site is working. The basic steps are:

  1. Generate a private Key file (only do this once, the first time you set up a site)
  2. Generate a Certificate signing request
  3. Pay a ton of money to a Certificate Authority to verify and issue the certificate (Thwate or similar)
  4. Put key on server.

Regarding permissions, make sure the key/crt are only readable/writable by root (chmod 600) otherwise Apache will moan.

Hope this helps

share|improve this answer
I updated the question with a little bit of what has been going on in my head, care to take a look? – ThomasReggi Jun 28 '12 at 22:43
In order to test if the SSL is working on your Vhost, just make an amendment to your hosts file so that (or whatever domain you've set up) points to the IP address of your server. – Robbie Scourou Jul 3 '12 at 13:36

Seems like your cert file is unreadable (or missing)

[Thu Jun 28 15:01:02 2012] [error] Init: Unable to read server certificate from file /etc/apache2/ssl/

Did you check for permissions/paths?

Also, the dns has to be set-up or the certificate will show some error (depends on the browser)

share|improve this answer
I'm ok with the browser showing an error as long as it is set up and ready for me to setup dns. I'm checking the permissions now. – ThomasReggi Jun 28 '12 at 20:52
Its not permissions just made the csr 777 and the error is still there. – ThomasReggi Jun 28 '12 at 21:08
here's your answer Take care not to mix up the ‘csr’ (certificate signing request) and ‘crt’ (the signed certificate) in the ssl.conf file didnt notice its a CSR file, guess its not meant to be in the configat all – MitziMeow Jun 28 '12 at 22:12

You can download a Java program called Keystore Explorer to open and view the certificate to verify that it is valid. On thing with Apache is that the cert needs to be in a certain format. This website might help explain the format you need, which appears to be PEM .

share|improve this answer
I used openssl req -new -days 365 -nodes -keyout -out which is straight from the linode docs. Could this really be the case? – ThomasReggi Jun 28 '12 at 21:20
That looks like it would generate a PEM to me. Therefore, if you used that CSR to request a cert reply, it should be ok. – djangofan Jul 1 '12 at 3:19

Maybe i'm wrong but check if the file contains the certificate. Generally files with csr extension contains the request to be signed in a CA.

Also, you can check the permission and paths like another user has said, but i think the problem is about the content in the file.

You can check to delete the file and create a new blank file, and paste the certificate data into the file.


share|improve this answer
I created those files using openssl req -new -days 365 -nodes -keyout -out which is straight from the linode docs. They have stuff in them. – ThomasReggi Jun 28 '12 at 21:53
Except that's a certificate signing request (hence the req part). You need the actual certificate. – David Schwartz Jun 28 '12 at 22:15

You can't setup SSL until you have the actual certificate. What you have is a request for a certificate that should be sent to a certificate authority to have them issue a certificate. Also, while you can get the server working without DNS working, clients won't be able to access the server except by IP, which will generate a warning since the certificate can't validate the IP.

Update: It sounds like you've done everything right now. If there are any other issues, you can resolve them once the DNS is setup.

share|improve this answer
I have certificates updates question. ^^ – ThomasReggi Jun 28 '12 at 23:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.