Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to install SSL on my nginx reverse proxy with certified ssl keys but i get this message when i try to restart server:

Restarting nginx: [emerg]: SSL_CTX_use_PrivateKey_file("/etc/nginx/conf.d/cert.key") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
configuration file /etc/nginx/nginx.conf test failed

everyfiles are root:root with 600 permissions i've tested the certificats and they are validated with this website:

there are no trailing weird caracters in my keys, and has 64 caracter per line

here is my config file

server {
    listen   443;
    ssl on;
    ssl_certificate      conf.d/cert.pem;
    ssl_certificate_key  conf.d/cert.key;

    location / {
         proxy_pass         http://upstream1;
         proxy_redirect     off;
         proxy_buffering    off;
         proxy_set_header        Host            $host;
         proxy_set_header        X-Real-IP       $remote_addr;
         proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;


Any ideas? Thank you

share|improve this question
Are you using a chained certificate? If so, you should follow the instructions at the certificate authority. You need to include the chained certificate as well. Alsom, I strongly discourage you from uploading your certificates to a random website. If they're saving what's uploaded your cert has already been compromised. You can do the verification with openssl directly yourself. – yoonix Jan 31 '14 at 19:43
yes i am. in my cert.pem i start with the root cert, then in the same file there is the intermediate cert. Now on my cert.key file there is two cert where the second one starts with -----BEGIN RSA PRIVATE KEY----- – Fredow Feb 3 '14 at 5:15
up vote 1 down vote accepted

check here

I hope you've copy-pasted with the following lines:

share|improve this answer
the cert.pem in that exemple acts as ssl_certificate or ssl_certificate_key ? – Fredow Feb 3 '14 at 5:15
extention .pem always acts as certificate. – Ilja Feb 3 '14 at 8:06
Yeah i had it already done. I have 4 keys in those 2 files, ill post the content of my keys here (this formatting is too good...): cert.pem : -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- cert.key -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY----- – Fredow Feb 3 '14 at 14:38
cert.key MUST contain only key: -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY----- – Ilja Feb 3 '14 at 15:51
Ive resolved locally my issue. The formatting of the keys are different with nginx vs apache, and the bundle key has 3 certificats inside it, not two. Thankx for your help IIja, it's much apreciated. – Fredow Feb 6 '14 at 19:59

A different solution that may work for others:

use the .pem file for both ssl_certificate and ssl_certificate_key

That is:

ssl on;
ssl_certificate      conf.d/cert.pem;
ssl_certificate_key  conf.d/cert.pem;
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.