I installed a new SSL certificate signed by our own Certificate Authority. Apache will not start, with the error:

SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

I have verified the key and cert Do match, so the error message is wrong. I have tred with and without the SSLCaCertificateFile directive. How do I fix this?

diff <(openssl rsa -in KEY -modulus -noout) <(openssl x509 -in CERT -modulus -noout)

produces no output, which I belive is corect.

The commands used to make the certificates:

Create a CA:

openssl genrsa -des3 -out ca.key 4096

Self sign the CA

openssl req -new -x509 -days 1826 -key my.key -out  my.crt

Generate a server key

openssl genrsa -out server.key 2048

Create a csr for the new key

openssl req -new -key server.key -out server.csr

Create a certificate from a CSR:

openssl x509 -req -in server.csr -CA my.crt -CAkey my.key -out server.crt -days 1820
  • What did you do to verify that the public and private key files match? Sep 11, 2013 at 3:43
  • I used an online tool that checks to see if they match.
    – Nick
    Sep 11, 2013 at 4:25
  • I just created a new key, csr and signed a new cert. Same error.
    – Nick
    Sep 11, 2013 at 4:36
  • I just started over with a brand new CA, new server certs and everything, and still get this error.
    – Nick
    Sep 11, 2013 at 4:56

2 Answers 2


I had more than one vhost file with SSL enabled.

The second host I didn't care about matching the domain because it was for private use. If you have more than one vhost with ssl on a single IP, you have to update the certificates in all of them at the same time, apparently.


Make sure you supply all the chain of certificates. You can also try to combine them in one .pem as described here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.