Apache SSL error: Private key not found

Question

I'm running apache on Ubuntu 14.04 and trying to implement SSL. Any help would be greatly appreciated.

default-ssl.conf has:

SSLCertificateFile      /etc/apache2/ssl/domain.crt 
SSLCertificateKeyFile   /etc/apache2/ssl/domain.csr

When I restart apache, the Error message in /var/log/apache2/error.log is:

[Sun Feb 01 19:31:06.443226 2015] [ssl:error] [pid 30927] AH02203: Init: Private key not found
[Sun Feb 01 19:31:06.443408 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Feb 01 19:31:06.443424 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 er$
[Sun Feb 01 19:31:06.443435 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Feb 01 19:31:06.443447 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Ty$
[Sun Feb 01 19:31:06.443458 2015] [ssl:error] [pid 30927] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Sun Feb 01 19:31:06.443468 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Sun Feb 01 19:31:06.443479 2015] [ssl:error] [pid 30927] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Ty$
[Sun Feb 01 19:31:06.443487 2015] [ssl:emerg] [pid 30927] AH02311: Fatal error initialising mod_ssl, exiting. See /var/log/apache2/error.log for more inf$

Answer 1

WARNING: Do not ever post your private key on internet. Do not even copy it to another computer, workstation etc. It must be kept as private as possible.

SSLCertificateKeyFile requires a Private Key. This key is usually generated before CSR or at the same time. Search for a file that starts with a line containing: BEGIN PRIVATE KEY

CSR (certificate signing request) is required only when you ask to sign the certificate. After that you can discard it.

If you lost the Private Key you will need to generate a new Private Key, then generate a new CSR and ask the CA (certificate authority) to sign the CSR again.

Answer 2

I know someone has already answered this question, but I wanted to let others know what happened to me when I got this error.

In my cause, I mistakenly had SSLCertificateFile instead of SSLCertificateChainFile for my cert bundle. This error kept appearing and was throwing me for a loop. I kept thinking my private key was wrong.

Answer 3

Here is the problem:

SSLCertificateKeyFile   /etc/apache2/ssl/domain.csr

You put your certificate signing request (CSR) file here by mistake. You should put there the private key file you used to generate the CSR instead. That private key file should not be password-protected, otherwise you would need to type a password every time you (re-)start Apache.

For the benefit of generations to come, here is a short summary of how to generate CSR-s with OpenSSL (a good tutorial is available from the Ubuntu documentation):

1) Generate the server key:

openssl genrsa -des3 -out server.key 2048

This requires you to specify a password.

2) Making a password-less private key, enter the password you used above when prompted:

openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.SECURE
mv server.key.insecure server.key

3) Generate the CSR with your password-less private key:

openssl req -new -key server.key -out mydomain.org.csr

where "mydomain.org" could be your domain. You have to answer a few questions interactively. Once you're done, you send the mydomain.org.csr file to your certificate authority. You will get back either a *.crt file or a *.pem file. Let's assume they gave you mydomain.org.crt. Install it as your cert and the passwordless key file as your key (the locations are valid for Ubuntu 14.04, they might be somewhere else on other systems, check the Apache2 docs):

sudo cp mydomain.org.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private/mydomain.org.key

And finally edit the Apache2 config (could be default-ssl.conf):

    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/mydomain.org.crt
    SSLCertificateKeyFile   /etc/ssl/private/mydomain.org.key

Hope this helps.

Answer 4

I know this post is old, but I figured I should add more to it since this is the first link on a google search about the error - "Init: Private key not found"

I've seen this happen before and it turned out to be a bad private key. I used strace to track down the last private key apache tried to load. Once I removed it from the ssl directory and the httpd.conf, Apache restarted without an issue.

Bad SSL Key: -rw-r----- 1 root 754974732 1.7K May 31 1987 /var/cpanel/ssl/installed/keys/c129e_4ed23_b7c0d7f821952179fc8006506ab06b72.key

Command used to track down the bad key: strace -f -v -s 1024 -o strace.log service httpd start

Environment: OS: CentSO 6.9 Control Panel: cPanel 11.64 Apache Version 2.2

tl;dr: Find the bad private key that Apache is trying to load and backup it up and remove it from Apache's configuration file.

I hope this helps!

Answer 5

I was spinning my wheels on this one for a bit but make sure you have a complete private key file. Turned out I had a couple of lines missing from mine.

The command to check your private key is:

openssl rsa -in /etc/httpd/certs/server.key -check

replace /etc/httpd/certs/server.key with the full path to your server's private key and if it's all good you'll see:

RSA key ok

Hope it helps someone and btw, my server was CentOS 7.6 with Apache/2.4.6