Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have recieved two files from the certification service : CSR.txt : Looks like this :

        -----BEGIN CERTIFICATE REQUEST-----
Code
-----END CERTIFICATE REQUEST-----

and Private_Key.txt with same format I'm trying to set them up on Nginx but I'm always getting this error when I restart Nginx

failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)

I have renamed CSR.txt to domain.crt and private_key.txt to domain_key.key my nginx config :

server {
    listen 443;
    server_name domain.com;

    root html;
    index index.html index.htm;

    ssl on;
    ssl_certificate /etc/ssl/certs/domain.crt;
    ssl_certificate_key /usr/share/nginx/www/domain.com/domain_key.key;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
    ssl_prefer_server_ciphers on;

    location / {
        try_files $uri $uri/ =404;
    }
}
share|improve this question
    
Then what should I do ? –  Aymane Shuichi Oct 14 '13 at 15:07
    
Moved mine to an answer. You need to ask your SSL provider for a certificate, or dig deeper into the files they gave you and find it if they already have. –  ceejayoz Oct 14 '13 at 15:09
    
Ok , I'll send them an email –  Aymane Shuichi Oct 14 '13 at 15:10

2 Answers 2

up vote 2 down vote accepted

As per ceejayoz. In most cases the process works like:

You generate:

cert.key
cert.csr (using cert.key)

You send cert.csr to the certification service (CA). The CA sends you:

cert.pem

cert.pem is your signed certificate and should look like:

-----BEGIN CERTIFICATE REQUEST-----
MIICpjCCAY4CAQAwYTEaMBgGA1UEAxMRZG9jcy4zY2JldGEuY28udWsxDzANBgNV
...
efqf6gYqezWiXs1s5aNh363F1j+o7TWi0D5ayEBv/lihAmLs4dsaJzSvZiWVxnIr
5hUED99Ne1WUbg==
-----END CERTIFICATE REQUEST-----

The key cert.key should look like:

-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAqXpfLXr2oRPwP+Pt4Az+iHldiHrIDnVW/uWY3MPvAJN8BWLe
...
f2UKtbEUsSDQ2BWiQia/3VUzLOlDArYxqA7kZFKes2z9ji8vobPG27o=
-----END RSA PRIVATE KEY-----

The CSR cert.csr should look like:

-----BEGIN CERTIFICATE REQUEST-----
MIIEqjCCApICAQAwZTEeMBwGA1UEAxMVZGV2Y2lyY3MuM2NiZXRhLmNvLnVrMQ8w
...
MctmU41Owfq+sIOGZ7G4zZqezUYownWt13hbprLk4DtWWEENRmvNinl0uCjAUA==
-----END CERTIFICATE REQUEST-----

Some CA's will generate the key and CSR for you as a convenience (startssl can do this) but either way to operate your nginx site you need only the cert.pem and key.pem files. Can you get those from the certificate source?

When you get them you should be able to do:

openssl rsa -in key.pem -modulus

openssl rsa -in cert.pem -modulus

That will print out the cert and the key modulus. They must match.

You can dump a request with:

openssl req -in cert.csr

Hope that helps.

share|improve this answer
    
How do you send cert.csr to the certification service (CA)? –  Aymane Shuichi Oct 14 '13 at 15:35
    
Aymane, usually you paste it's contents into the CA's web portal when you are requesting the certificate and parting with the money for the cert. The CSR can go anywhere, it's the .key file you must keep safe. –  davey Oct 14 '13 at 15:45

A CSR is a request for a certificate, not a certificate. In most cases, it's something you'd generate, not someone else.

It is used by your SSL provider to create a certificate, which they'd provide you (as a .crt file, usually).

Incidentally, it's better for security if you generate the private key (as it's supposed to be private). Follow @davey's instructions to build one and the requisite CSR.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.