Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running RHEL 6.4 and my trusted certificate has expired recently, so I decided to renew it. I've obtained a new certificate from StartSSL. After downloading and putting the certificate file on the server, I specified the new certificate in httpd.d/ssl.conf.

/sbin/service httpd configtest

says Syntax OK, but

/sbin/service httpd restart

causes [FAILED] result with no error message. Where can I find the actual reason?

UPDATE:

[error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
[warn] RSA server certificate CommonName (CN) `www.mywebsite.com' does NOT match server name!?

these lines were found in error_log of particular viruatal host.

(www.mywebsite.com is substitution of real domain for conspiracy reason of course)

share|improve this question
    
Have you checked /var/log/httpd/error_log? –  Cristian Ciupitu Mar 30 at 21:20
2  
Are you using the correct key, the key you used to create the CSR that you send to startssl? If you are using your old key and new cert apache does fail to start. –  Shutupsquare Mar 30 at 21:20
    
only "[notice] caught SIGTERM, shutting down" in /var/log/httpd/error_log –  heximal Mar 30 at 21:21
    
what if I used old key for producing csr? is it wrong way? is it necessary to genereate new private key for csr each time? –  heximal Mar 30 at 21:24
2  
Also check the error log for this particular virtual host. –  Michael Hampton Mar 30 at 21:32

1 Answer 1

x509 certificate routines:X509_check_private_key:key values mismatch means that the private key you have specified does not match the public key in the certificate you have specified.

Make sure that you are referencing the correct key and certificate files in your configuration.

RSA server certificate CommonName (CN) 'www.mywebsite.com' does NOT match server name!? may be a sign that it is the wrong certificate that has been specified.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.