I am attempting to install both an SSL certificate and an intermediate certificate on an Apache web server. To do this I have had to install mod_ssl (using a2enmod ssl)

First I set that up and restarted Apache, it loaded fine.

Then I set up the certificates and attempted a restart - this appeared in the error logs (error.log);

[Mon Oct 24 04:17:48 2011] [error] Init: Unable to read server certificate from file /etc/apache2/ssl.key/ssl-cert.crt

After some digging I noticed the SSL cert was malformed (everything was on one line), I re-copied everything across for both the main crt and intermediate crt and attempted a restart again, again it failed but this time nothing was written to the error log.

When I run openssl x509 -noout -modulus -in /etc/apache2/ssl.key/ssl-cert.crt I get a modulus returned (something that wasn't happening before I fixed the formatting of text in the files).

If I take out the <VirtualHost *:443> block in my Apache config file, it starts fine.

Apache is running as www-data

Any help would be greatly appreciated.

Linux Info

cat proc /etc/*-release

Apache Info

apache2 -v
Server version: Apache/2.2.14 (Ubuntu)
Server built:   Sep  1 2011 09:45:41

SSL Info

-rwxrwxr-x  1 root root 1.8K 2011-10-24 04:19 ssl-cert.crt
-rwxrwxr-x  1 root root 1.6K 2011-10-24 04:19 intermediate.crt
-rwxrwxr-x  1 root root 1.7K 2011-10-10 09:24 ssl-cert.key

Site Info

<VirtualHost *:443>
    ServerName www.mysite.co.uk
    DocumentRoot /srv/www/mysite/public_html
    ErrorLog /srv/www/mysite/logs/error.log
    CustomLog /srv/www/mysite/logs/access.log combined
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl.key/ssl-cert.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/ssl-cert.key
    SSLCertificateChainFile /etc/apache2/ssl.key/intermediate.crt

Did you change the permission of /root or are you running apache as root?
Verify that Apache has permissions to read the files (and folders below).

Also I would not place the certificates in /root, but rather in /etc/apache.

| improve this answer | |
  • /root is world readable (there is nothing in it bar the certs) so it should be accessible by www-data (the user Apache runs as) but I will move them into the /etc/apache folder – Toby Oct 24 '11 at 9:08
  • It would also need to be world executable – faker Oct 24 '11 at 9:10
  • Thanks, I also added this permission - no joy - I will update my original question. – Toby Oct 24 '11 at 9:14

The solution in my case was to check the site specific error logs, I hadn't looked there previously because I thought they only came into action was Apache was up and running.

There was an issue with the generated crt file, which was plain as day once I was in the right logs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.