Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to install an SSL certificate on my Ubuntu server. I have purchased the certificate from my CA and have downloaded the certificate itself and an intermediate certificate. As so:

my certificate: mydomain.crt
intermediate certificate: GandiStandardSSLCA.pem

I also have (made using openssl)

my private key (?): mydomain.key
and signing request: mydomain.csr

I have uploaded all these files to my server and followed a guide to combine my certificate with the intermediate:

cat mydomain.crt GandiStandardSSLCA.pem > mydomain-bundle.crt

I then add the following to my vhost's config:

listen   443 ssl;
ssl_certificate       /etc/nginx/ssl/mydomain-bundle.crt;
ssl_certificate_key   /etc/nginx/ssl/mydomain.key;

But when I go to restart nginx I get this error:

* Restarting nginx
* Stopping nginx nginx [ OK ]
nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/mydomain.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) nginx: configuration file /etc/nginx/nginx.conf test failed

Any ideas why and how to solve?

share|improve this question
what "openssl verify -untrusted ca-bundle mydomain-bundle.crt" say? – Danila Ladner Jan 30 '14 at 22:15
what is ca-bundle? – harryg Jan 30 '14 at 22:43

Does your key list ok:

openssl rsa -in /etc/nginx/ssl/mydomain.key

Do the modulus of the key and the cert match:

openssl x509  -in mydomain.crt -modulus 

openssl rsa  -in qa.server.key  -modulus

These numbers must match.

share|improve this answer
yes, the key lists ok and the modulae match. I could only list in as root though. Could it be an ownership issue – harryg Jan 30 '14 at 22:42
assuming qa.server.key is my private key – harryg Jan 30 '14 at 23:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.