Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error:

SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

I have verified the key and cert Do match, so the error message is wrong. I have tred with and without the SSLCaCertificateFile directive. How do I fix this?

diff <(openssl rsa -in KEY -modulus -noout) <(openssl x509 -in CERT -modulus -noout)

produces no output, which I belive is corect.

The commands used to make the certificates:

Create a CA:

openssl genrsa -des3 -out ca.key 4096

Self sign the CA

openssl req -new -x509 -days 1826 -key my.key -out  my.crt

Generate a server key

openssl genrsa -out server.key 2048

Create a csr for the new key

openssl req -new -key server.key -out server.csr

Create a certificate from a CSR:

openssl x509 -req -in server.csr -CA my.crt -CAkey my.key -out server.crt -days 1820
share|improve this question

migrated from stackoverflow.com Sep 11 '13 at 3:29

This question came from our site for professional and enthusiast programmers.

    
What did you do to verify that the public and private key files match? –  Shane Madden Sep 11 '13 at 3:43
    
I used an online tool that checks to see if they match. –  Nick Sep 11 '13 at 4:25
    
I just created a new key, csr and signed a new cert. Same error. –  Nick Sep 11 '13 at 4:36
    
I just started over with a brand new CA, new server certs and everything, and still get this error. –  Nick Sep 11 '13 at 4:56

1 Answer 1

I had more than one vhost file with SSL enabled.

The second host I didn't care about matching the domain because it was for private use. If you have more than one vhost with ssl on a single IP, you have to update the certificates in all of them at the same time, apparently.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.