Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am pretty new to linux and am attempting to configure an SSL from Go Daddy. I followed the instructions on how to generate the key to send to Go Daddy for the cert. Here is the guide I followed: http://support.godaddy.com/help/article/5269/generating-a-certificate-signing-request-csr-apache-2x?pc_split_value=1

For the password I just hit enter at the prompt and did not specify any password. They issued the cert and I have setup virtual host on my apache2 server. I enabled modSSL with apache. This is the log I get when I restarted apache:

[Fri Aug 24 02:32:37 2012] [notice] Apache/2.2.17 (Ubuntu) PHP/5.3.5-1ubuntu7.10 with Suhosin-Patch mod_ssl/2.2.17 OpenSSL/0.9.8o configured -- resuming normal operations

I setup the following virtual host information (private details omitted for security):

<VirtualHost IP_ADDRESS_HERE:443>
ServerAdmin MY_EMAIL
ServerName WWW_SERVER_NAME_COM
DocumentRoot PATH_TO_HTDOCS
<Directory />
    Options FollowSymLinks
    AllowOverride All
</Directory>

ErrorLog PATH_TO_LOGS/error.log
CustomLog PATH_TO_LOGS/access.log combined
SSLEngine on
SSLCertificateFile PATH_TO_SSL/MY_SITE_NAME.com.crt
SSLCertificateKeyFile PATH_TO_SSL/MY_SITE_NAME.csr
SSLCertificateChainFile PATH_TO_SSL/gd_bundle.crt
</VirtualHost>

When I go to restart apache after I added those details to my virtual host I receive the following error message in my error log:

[Fri Aug 24 02:23:55 2012] [error] Init: Private key not found
[Fri Aug 24 02:23:55 2012] [error] SSL Library Error: 218710120 error:0D094068:asn1     encoding routines:d2i_ASN1_SET:bad tag
[Fri Aug 24 02:23:55 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Fri Aug 24 02:23:55 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Fri Aug 24 02:23:55 2012] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib
[Fri Aug 24 02:28:02 2012] [error] Init: Private key not found
[Fri Aug 24 02:28:02 2012] [error] SSL Library Error: 218710120 error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag
[Fri Aug 24 02:28:02 2012] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Fri Aug 24 02:28:02 2012] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Fri Aug 24 02:28:02 2012] [error] SSL Library Error: 218734605 error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib

I'm new to using SSL with apache so any help would be greatly appreciated. I have done a good bit of Googling and have attempted to follow what's out there best I could but I am hoping that a seasoned expert can spot a noob mistake.

If I remove the SSL info I can view the site from MY_SITE:443 so the port is open and apache is listening/serving.

share|improve this question

migrated from stackoverflow.com Aug 24 '12 at 12:06

This question came from our site for professional and enthusiast programmers.

    
When you downloaded the cert from GoDaddy, did you choose the correct format? I seem to remember that you can get the cert in various formats. –  Bittrance Aug 24 '12 at 12:42
    
You can. I selected Apache though and it did work after following larsks' advice. I had the csr where the key should have been. After that it worked like a charm. –  Chason Arthur Aug 26 '12 at 1:25

1 Answer 1

up vote 3 down vote accepted

You're haven't installed your private key. This...

SSLCertificateKeyFile PATH_TO_SSL/MY_SITE_NAME.csr

...is pointing at your Certificiate Signing Request (CSR), which is basically a "pre-certificate" that has been signed with your private key. You send this to the SSL provider and they sign it with their private key, and now you have a certificate.

You generated your private key when you ran this command:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout yourdomain.key -out yourdomain.csr

The -keyout option indicates that your key is in a file called yourdomain.key. This is what needs to be supplied to the SSLCertificateKeyFile option in your Apache configuration.

share|improve this answer
    
Dude you completely rock my world with the windows down! Thank you so very much for taking the time to help me. You single-handedly saved my weekend! It worked perfect. –  Chason Arthur Aug 25 '12 at 11:53
    
I tried to give you an up-vote but my rep is too low. I accepted it and will give you a vote as soon as they let me. –  Chason Arthur Aug 25 '12 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.