After a yum update, there is an error when starting apache, in /var/log/httpd/error_log:

[notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[error] SSL Library Error: -8181 Certificate has expired
[error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

Now I temporary put NSSEnforceValidCerts off in nss.conf to have the site running. How can I fix the error?

  • 1
    Do you really use mod_nss ? Can you try to remove nss.conf from /etc/httpd/conf.d then restart Apache and test your website. What happens ?
    – krisFR
    Feb 25, 2014 at 2:49
  • Apache starts OK if nss.conf is removed from /etc/httpd/conf.d.
    – ohho
    Feb 25, 2014 at 2:55

4 Answers 4


Seems that a certificate was created when mod_nss was installed.

This certificate has expired, preventing the restarting of httpd (Apache).

Do you really use mod_nss ?

If you aren't using mod_nss then your best bet is to simply uninstall the package.

However you have some alternatives :

  • Remove nss.conf from /etc/httpd/conf.d (this will cause mod_nss to not be loaded).

  • Uninstall/re-install your nss rpm modules. On re-installation a new certificate will be generated and your problem will go away for a few more years :

    rpm -e mod_nss
    rm /etc/httpd/alias/*
    yum install mod_nss
    service httpd restart

For anyone who is reading this, you don't need to remove the mod_nss. You can just re-issue the certificate:

  • Take a backup of the current alias folder
    mv /etc/httpd/alias /etc/httpd/alias_2023_10_23

  • Create a new alias folder
    mkdir /etc/httpd/alias

  • Generate the new certificate, when asked for a password press enter (no password)
    gencert /etc/httpd/alias/

  • Verify the new certificate is valid
    certutil -d /etc/httpd/alias -L -n Server-Cert

  • Change group ownership for the following files:

chown root:apache /etc/httpd/alias/secmod.db 
chown root:apache /etc/httpd/alias/key3.db
chown root:apache /etc/httpd/alias/cert8.db
ln -s /usr/lib64/libnssckbi.so libnssckbi.so
  • Change permissions on the files
chmod 640 /etc/httpd/alias/secmod.db
chmod 640 /etc/httpd/alias/key3.db
chmod 640 /etc/httpd/alias/cert8.db
  • Restart Apache
    systemctl start httpd

The Server-Cert is expired, checked by:

certutil -d /etc/httpd/alias -L -n Server-Cert

At the moment, mod_nss is disable by removing nss.conf from /etc/httpd/conf.d/.

dnf remove mod_nss
rm /etc/httpd/alias/*
dnf install mod_nss
systemctl restart httpd

the important is remove /etc/httpd/alias/* before reinstall it

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .