I am trying to enable ssl on a server using a certificate from 123-reg but I keep getting this error:

nginx: [emerg] SSL_CTX_use_certificate_chain_file("/opt/nginx/conf/cleantechlms.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)

This is my nginx config:

server {
  listen 443;
  server_name a-fake-url.com;
  root /file/path/public;   
  passenger_enabled on;

  ssl on;
  ssl_certificate /opt/nginx/conf/cleantechlms.crt;
  ssl_certificate_key /opt/nginx/conf/cleantechlms.key;

I have tried setting my crt and key to full file permissions but there is no difference.

My crt file is the crt I was issued concatenated with the ca crt.


I have tried copying both the keys in sperate files and then running 'cat mykey.crt >> ca.cert'

Also I tried manually copying the keys into the same file.

Any ideas?

  • Your /opt/nginx/conf/cleantechlms.crt is broken somehow. How did you create it? Could you post all steps you did? – VBart Dec 4 '12 at 20:21
  • In cleantechlms.crt you want to have only your public certificate without key and chain certificates from your ca. If you open it in text editor you should see just --BEGIN-CERTIFICATE-- blocks.. – week Dec 5 '12 at 0:11

Thanks for your help, this is how I solved it:

  • Copy the certificates into a text editor to ensure there is no whitespace (I had already done this)

  • Ensure the beginning and end certificate statements are on there own line and have the same number of '-' at each end.

  • Ensure each line has 64 chars (except the last line)

  • I also got the error when the .cer file contained only the top level cert and not the entire bundled / chain of certs (intermediate and root ca) – radtek May 7 '15 at 15:20

I ended up with same exception and got it fixed by adding private key(x.509 + privatekey at the end) in the same pem file (pem format). I think its because I used to have the same format and validating the config with "nignx -t".

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.