Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to install an SSL certificate on my Ubuntu server. I have purchased the certificate from my CA and have downloaded the certificate itself and an intermediate certificate. As so:

my certificate: mydomain.crt
intermediate certificate: GandiStandardSSLCA.pem

I also have (made using openssl)

my private key (?): mydomain.key
and signing request: mydomain.csr

I have uploaded all these files to my server and followed a guide to combine my certificate with the intermediate:

cat mydomain.crt GandiStandardSSLCA.pem > mydomain-bundle.crt

I then add the following to my vhost's config:

listen   443 ssl;
ssl_certificate       /etc/nginx/ssl/mydomain-bundle.crt;
ssl_certificate_key   /etc/nginx/ssl/mydomain.key;

But when I go to restart nginx I get this error:

* Restarting nginx
* Stopping nginx nginx [ OK ]
nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/mydomain.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) nginx: configuration file /etc/nginx/nginx.conf test failed

Any ideas why and how to solve?

share|improve this question
    
what "openssl verify -untrusted ca-bundle mydomain-bundle.crt" say? –  Danila Ladner Jan 30 at 22:15
    
what is ca-bundle? –  harryg Jan 30 at 22:43

1 Answer 1

Does your key list ok:

openssl rsa -in /etc/nginx/ssl/mydomain.key

Do the modulus of the key and the cert match:

openssl x509  -in mydomain.crt -modulus 

openssl rsa  -in qa.server.key  -modulus

These numbers must match.

share|improve this answer
    
yes, the key lists ok and the modulae match. I could only list in as root though. Could it be an ownership issue –  harryg Jan 30 at 22:42
    
assuming qa.server.key is my private key –  harryg Jan 30 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.