In Ubuntu when i was trying to execute openssl s_server -cert server.pem -www I get the following message

unable to load certificate
3074300104:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE

Please help.

  • Welcome to Serverfault Sahithi. You will get a better response if you clean up the question a bit. I recommend making the subject more descriptive and something that people can understand. Jan 28, 2013 at 18:18
  • And state what you are trying to accomplish. Are you really trying to implement a generic SSL/TLS server which listens for connections on a given port using SSL/TLS (From the s_server manpage). Jan 28, 2013 at 18:25
  • Yes Stefan . Am trying to launch the web server using server.pem file which should contain key and certificate. And I Am trying to access the server using the following URL: PKILabServer.com:4433
    – Sahithi
    Jan 28, 2013 at 18:44
  • 1
    Most people use Apache or NGINX to serve SSL content. openssl s_server is generally only used for for debugging. Why are you using openssl s_server? What are you trying to accomplish? Jan 28, 2013 at 18:52

1 Answer 1


Is server.pem actually a certificate? Run

grep '^-----.*CERTIFICATE' server.pem

You should see the beginning and ending of the certificate:

server.pem:-----BEGIN CERTIFICATE-----
server.pem:-----END CERTIFICATE-----

If you don't see this output, you are not using a valid certificate.

Also, I note that you are running the following unusual command:

openssl s_server -cert server.pem -www

This command does:

  • s_server - starts a very basic openssl server
  • -cert server.pem - uses the certificate server.pem
  • -www - "sends a status message back to the client when it connects. This includes lots of information about the ciphers used and various session parameters. The output is in HTML format so this option will normally be used with a web browser."

openssl s_server is generally only used for for debugging. Why are you using openssl s_server? What are you trying to accomplish?

  • when i ran it ..I got -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
    – Sahithi
    Jan 28, 2013 at 18:16
  • server.pem contains certficate and key .
    – Sahithi
    Jan 28, 2013 at 18:21
  • 2
    @Sahithi, as your command output shows, the file does not contain the certificate and key. server.pem only contains the key, and thus -cert is correct when it says unable to load certificate. There is no certificate. Jan 28, 2013 at 18:23
  • I have two files server.key and server.crt . Itried to put them in a file server.pem using %cp server.key server.pem % cat server.crt >> server.pem
    – Sahithi
    Jan 28, 2013 at 18:29
  • I also checked ...grep '^-----' server.crt..But the beginning and ending of the certificate was not displayed. Is there a problem with the certificate?
    – Sahithi
    Jan 28, 2013 at 18:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.