Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use self-signed certificates with no issue but today I have tried to create a SSL certificate for commercial use. But apache doesn't start and gives the following error:

Notice: I have confirmed that crt file is valid as CSR decoder loads the content as well.

*AH02241: Init: Unable to read server certificate from file XXXX/XXXX/XXXX.csr SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=X509) AH02312: Fatal error initialising mod_ssl, exiting.*

Softwares: OpenSSL 1.0.1e 11 Feb 2013 , Apache HTTP 2.4.6

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

Looks like you are using CSR instead of the certificate file. Make sure you have created self-signed certificate with openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt and use the server.crt in the SSLCertificateFile setting in apache ssl config. If you are using a commercial signing authority you must use the certificate provided by the authority and not the signing request generated.

share|improve this answer
    
yes, I have checked. Starts with -----BEGIN PRIVATE KEY----- , and ends with -----END PRIVATE KEY----- –  user196395 Oct 27 '13 at 17:19
    
checked that the apache user has permissions to access the csr files and key files? –  mindsurfer Oct 27 '13 at 17:20
    
yes, it has.... –  user196395 Oct 27 '13 at 17:23
    
ok and anything in ssl_error_log? –  mindsurfer Oct 27 '13 at 17:29
    
Nope, everything is just fine. "openssl req -text -noout -verify -in XXX.csr" AND "openssl rsa -in XXX.key -check" –  user196395 Oct 27 '13 at 17:50
show 15 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.