5

I'm attempting to install Apache with SSL on CentOS6 to use as a development server.

I've been following the directions posted here to get SSL working: http://wiki.centos.org/HowTos/Https (Note: Apache was working fine until I attempted to enable SSL.)

When I got to part about re-starting Apache, the server wouldn't start. I just get an error which follows:

[Mon Feb 13 18:31:36 2012] [error] (13)Permission denied: Init: Can't open 
 server certificate file /etc/pki/tls/certs/ca.crt

I saw that the reported certificate was owned by my user and my group, so I changed it to root:root but it made no difference. I'm not sure what else to try or what to look at. Thanks.

Note: My questions is similar to this but the error is different.

Improve this question
4
  • 1
    What is the result of running getenforce? Did you use copy like the docs say when creating the certificate?
    – becomingwisest
    Feb 14, 2012 at 2:42
  • 1
    "getenforce" returns "Enforcing"
    – Frank V
    Feb 14, 2012 at 2:44
  • Yes, I double checked that it was a copy.
    – Frank V
    Feb 14, 2012 at 2:44
  • 1
    Christopher -- apparently that was it, in a way. I want to give you credit for the answer. Could you write something along the lines of using the restorecon piece? When you posted that, I recalled that there were directions to run restorecon -RvF /etc/pki. I ran this as a precaution and now the server starts.
    – Frank V
    Feb 14, 2012 at 2:50

1 Answer 1

Reset to default
11

So for anyone who doesn't understand what the answer actually is here:

This is an selinux issue. Files can have different selinux "contexts" and a file with the wrong context will be unreadable by the httpd daemon even if the regular permissions are correct. In my case, the solution was to do the following:

chcon --reference /file/with/correct/context /path/to/certificate/file

Which will copy the context from the referenced file to the certificate. In case you don't have a file you can reference, the slightly trickier way (because of having to type it out) to set the correct context is:

chcon unconfined_u:object_r:httpd_config_t:s0 /path/to/certificate/file
Improve this answer
1
  • One might encounter this issue when uploading the key file as a regular user, then using sudo mv (with requisite sudo chown) to install. Safest route is to cat > /path/to/file.crt < /path/to/source.crt.
    – bishop
    Oct 31, 2014 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.