Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running RHEL 6.4 and my trusted certificate has expired recently, so I decided to renew it. I've obtained a new certificate from StartSSL. After downloading and putting the certificate file on the server, I specified the new certificate in httpd.d/ssl.conf.

/sbin/service httpd configtest

says Syntax OK, but

/sbin/service httpd restart

causes [FAILED] result with no error message. Where can I find the actual reason?


[error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
[warn] RSA server certificate CommonName (CN) `' does NOT match server name!?

these lines were found in error_log of particular viruatal host.

( is substitution of real domain for conspiracy reason of course)

share|improve this question
Have you checked /var/log/httpd/error_log? – Cristian Ciupitu Mar 30 '14 at 21:20
Are you using the correct key, the key you used to create the CSR that you send to startssl? If you are using your old key and new cert apache does fail to start. – squarebear Mar 30 '14 at 21:20
only "[notice] caught SIGTERM, shutting down" in /var/log/httpd/error_log – heximal Mar 30 '14 at 21:21
what if I used old key for producing csr? is it wrong way? is it necessary to genereate new private key for csr each time? – heximal Mar 30 '14 at 21:24
Also check the error log for this particular virtual host. – Michael Hampton Mar 30 '14 at 21:32
up vote 2 down vote accepted

x509 certificate routines:X509_check_private_key:key values mismatch means that the private key you have specified does not match the public key in the certificate you have specified.

Make sure that you are referencing the correct key and certificate files in your configuration.

RSA server certificate CommonName (CN) '' does NOT match server name!? may be a sign that it is the wrong certificate that has been specified.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.