0

I renewed my SSL certificate at a very well known company, who screwed up my order. After it was righted, I received several certificate files with no instructions:

  • MY.SERVER.COM.crt
  • OV_ThatCompanyOVServerCA2.crt
  • AddTrustExternalCARoot.crt
  • OV_USERTrustRSACertificationAuthority.crt

So I remembered that I needed to concatenate them together. I did that, although who knows if I have the right order because there are thousands of conflicting instructions I found on Google.

I installed the certificate in my nginx server. Then I get this:

nginx: [emerg] SSL_CTX_use_PrivateKey_file("/usr/nginx/conf/myserver.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

Uh-oh. I don't have a .key file this time. All I have are:

  • privkey.pem
  • myserver.csr

So the old key file doesn't work. I tried substituting the privkey.pem file and got this:

Enter PEM pass phrase:

Well, who knows what that is. I didn't think I created a pass phrase.

I have no idea what to do next. How do I generate a key file that will work?

Improve this question

2 Answers 2

Reset to default
1

I ran this command to generate a key from a PEM file:

openssl rsa -in privkey.pem -outform PEM -out myserver.key

It prompted me for the key again, but I guessed it. I put this key in the the nginx/conf directory and everything worked.

Improve this answer
0

If you renewed the previous certificate, the old .key file you used in nginx should work with the new certificate file.

Also, if you are not sure how the certificates should be concatenated, you might be able to replace the first certificate in your previous .crt file with the one in MY.SERVER.COM.crt file. This might not be possible though if the certificate chain has changed.

Improve this answer
3
  • The old key is not working for some reason.
    – RubyRedGrapefruit
    Jul 23, 2015 at 1:14
  • The suggestion of modifying the existing certificate chain file instead of concatenating the CA-supplied intermediate certificates assumes that the chain has not changed compared to the old certificate. That's not necessarily the case, especially with the ongoing transition to SHA2-based signatures it's even quite likely that the new certificate has different intermediates.
    – Håkan Lindqvist
    Jul 23, 2015 at 1:28
  • Thanks @Håkan for the comment, you are 100% correct. I changed my answer to reflect for this.
    – Tero Kilkanen
    Jul 23, 2015 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .