5

I'm attempting to install Apache with SSL on CentOS6 to use as a development server.

I've been following the directions posted here to get SSL working: http://wiki.centos.org/HowTos/Https (Note: Apache was working fine until I attempted to enable SSL.)

When I got to part about re-starting Apache, the server wouldn't start. I just get an error which follows:

[Mon Feb 13 18:31:36 2012] [error] (13)Permission denied: Init: Can't open 
 server certificate file /etc/pki/tls/certs/ca.crt

I saw that the reported certificate was owned by my user and my group, so I changed it to root:root but it made no difference. I'm not sure what else to try or what to look at. Thanks.

Note: My questions is similar to this but the error is different.

Improve this question
4
  • 1
    What is the result of running getenforce? Did you use copy like the docs say when creating the certificate?
    – becomingwisest
    Commented Feb 14, 2012 at 2:42
  • 1
    "getenforce" returns "Enforcing"
    – Frank V
    Commented Feb 14, 2012 at 2:44
  • Yes, I double checked that it was a copy.
    – Frank V
    Commented Feb 14, 2012 at 2:44
  • 1
    Christopher -- apparently that was it, in a way. I want to give you credit for the answer. Could you write something along the lines of using the restorecon piece? When you posted that, I recalled that there were directions to run restorecon -RvF /etc/pki. I ran this as a precaution and now the server starts.
    – Frank V
    Commented Feb 14, 2012 at 2:50

1 Answer 1

Reset to default
11

So for anyone who doesn't understand what the answer actually is here:

This is an selinux issue. Files can have different selinux "contexts" and a file with the wrong context will be unreadable by the httpd daemon even if the regular permissions are correct. In my case, the solution was to do the following:

chcon --reference /file/with/correct/context /path/to/certificate/file

Which will copy the context from the referenced file to the certificate. In case you don't have a file you can reference, the slightly trickier way (because of having to type it out) to set the correct context is:

chcon unconfined_u:object_r:httpd_config_t:s0 /path/to/certificate/file
Improve this answer
1
  • One might encounter this issue when uploading the key file as a regular user, then using sudo mv (with requisite sudo chown) to install. Safest route is to cat > /path/to/file.crt < /path/to/source.crt.
    – bishop
    Commented Oct 31, 2014 at 0:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .