Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I got a new set of keys for my apache2 server, the old ones expired, and I'm at a loss how to troubleshoot.

I tried to just copy the new keys to the keystore at /etc/ssl/ and rewrote the paths directives in the apache2 conf.

    SSLEngine On
    SSLOptions +StrictRequire

    SSLCertificateFile /etc/ssl/certs/serv.er.tld.pem
    SSLCertificateKeyFile /etc/ssl/private/serv.er.tld.key
    SSLCertificateChainFile /etc/ssl/certs/chain-thisisanumber-serv.er.tld.pem

What i get is

Unable to configure RSA server private key
SSL Library Error: 185073780 error:0B080074:x509 certificate
routines:X509_check_private_key:key values mismatch

The new set is similar to the old one but it has a few more files. Do I need to reference these in any way?

For instance one of the files is

chain-thisisanumber-serv.er.tld-3-AddTrust_External_CA_Root.pem

How do I troubleshoot this?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You can't have two VirtualHosts using different keys.

The problem was in another virtual host using another set of keys. This is apparently a no-no. Also it fails silently, no error message in either of the hosts log-files.

share|improve this answer

Your key and cert are a key pair. You shouldn't get new keys without new certs. You can get a new cert without a new key. That depends on if you used your existing key to create the new cert request. Make sure you're updating your certs at the same time. As for your chain file, I'd check the md5sum and if it differes from your existing SSLCertificateChainFile I'd back up the old one and replace it with the new one. I hope this helps!

share|improve this answer
    
Both cert and key are new for me. I did not request the new certs from a CA, but rather an IT department. Still; it is likely the main keys are the same. What does the chain files do? I have a total of 4 chain files. The apache docs are unclear on the subject. –  Captain Giraffe Mar 19 '13 at 22:14
    
I dug this command up for you. It will give us more insight to your problem. openssl x509 -noout -text -in /etc/ssl/certs/serv.er.tld.pem openssl rsa -noout -text -in /etc/ssl/private/serv.er.tld.key From the first command check that the cert's Modulus matches the keys's modulus from the second command. If they differ there is a problem with your key pair. Obviously you shouldn't post the output since it holds the cryptographics used in your cert! –  Vex Mage Mar 19 '13 at 22:17
    
Thanks for the effort, I did try them already, and they passed. From digicert.com/ssl-support/apache-fix-common-ssl-errors.htm –  Captain Giraffe Mar 19 '13 at 22:22
    
Apparently the modulus can match but the keys can still be invalid. This person says they got the the person who issued their cert to give them the cert in a format that contained both the cert and the key. You can convert a cert using the openssl cli. It would ensure that the person who sent you the cert didn't accidentally it. Good luck, it sounds like you have a gremlin! From: stackoverflow.com/questions/4658484/… –  Vex Mage Mar 19 '13 at 22:31
    
Gremlin is not likely, user error is a lot more probable. –  Captain Giraffe Mar 19 '13 at 22:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.