Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to enable ssl on a server using a certificate from 123-reg but I keep getting this error:

nginx: [emerg] SSL_CTX_use_certificate_chain_file("/opt/nginx/conf/cleantechlms.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)

This is my nginx config:

server {
  listen 443;
  root /file/path/public;   
  passenger_enabled on;

  ssl on;
  ssl_certificate /opt/nginx/conf/cleantechlms.crt;
  ssl_certificate_key /opt/nginx/conf/cleantechlms.key;

I have tried setting my crt and key to full file permissions but there is no difference.

My crt file is the crt I was issued concatenated with the ca crt.


I have tried copying both the keys in sperate files and then running 'cat mykey.crt >> ca.cert'

Also I tried manually copying the keys into the same file.

Any ideas?

share|improve this question
Your /opt/nginx/conf/cleantechlms.crt is broken somehow. How did you create it? Could you post all steps you did? – VBart Dec 4 '12 at 20:21
In cleantechlms.crt you want to have only your public certificate without key and chain certificates from your ca. If you open it in text editor you should see just --BEGIN-CERTIFICATE-- blocks.. – week Dec 5 '12 at 0:11
up vote 4 down vote accepted

Thanks for your help, this is how I solved it:

  • Copy the certificates into a text editor to ensure there is no whitespace (I had already done this)

  • Ensure the beginning and end certificate statements are on there own line and have the same number of '-' at each end.

  • Ensure each line has 64 chars (except the last line)

share|improve this answer
I also got the error when the .cer file contained only the top level cert and not the entire bundled / chain of certs (intermediate and root ca) – radtek May 7 '15 at 15:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.