Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to enable ssl on a server using a certificate from 123-reg but I keep getting this error:

nginx: [emerg] SSL_CTX_use_certificate_chain_file("/opt/nginx/conf/cleantechlms.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)

This is my nginx config:

server {
  listen 443;
  server_name a-fake-url.com;
  root /file/path/public;   
  passenger_enabled on;

  ssl on;
  ssl_certificate /opt/nginx/conf/cleantechlms.crt;
  ssl_certificate_key /opt/nginx/conf/cleantechlms.key;
 }

I have tried setting my crt and key to full file permissions but there is no difference.

My crt file is the crt I was issued concatenated with the ca crt.

Update

I have tried copying both the keys in sperate files and then running 'cat mykey.crt >> ca.cert'

Also I tried manually copying the keys into the same file.

Any ideas?

share|improve this question
    
Your /opt/nginx/conf/cleantechlms.crt is broken somehow. How did you create it? Could you post all steps you did? –  VBart Dec 4 '12 at 20:21
    
In cleantechlms.crt you want to have only your public certificate without key and chain certificates from your ca. If you open it in text editor you should see just --BEGIN-CERTIFICATE-- blocks.. –  week Dec 5 '12 at 0:11

1 Answer 1

up vote 2 down vote accepted

Thanks for your help, this is how I solved it:

  • Copy the certificates into a text editor to ensure there is no whitespace (I had already done this)

  • Ensure the beginning and end certificate statements are on there own line and have the same number of '-' at each end.

  • Ensure each line has 64 chars (except the last line)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.