After a yum update, there is an error when starting apache, in /var/log/httpd/error_log:

[notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[error] SSL Library Error: -8181 Certificate has expired
[error] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

Now I temporary put NSSEnforceValidCerts off in nss.conf to have the site running. How can I fix the error?

  • 1
    Do you really use mod_nss ? Can you try to remove nss.conf from /etc/httpd/conf.d then restart Apache and test your website. What happens ?
    – krisFR
    Feb 25, 2014 at 2:49
  • Apache starts OK if nss.conf is removed from /etc/httpd/conf.d.
    – ohho
    Feb 25, 2014 at 2:55

3 Answers 3


Seems that a certificate was created when mod_nss was installed.

This certificate has expired, preventing the restarting of httpd (Apache).

Do you really use mod_nss ?

If you aren't using mod_nss then your best bet is to simply uninstall the package.

However you have some alternatives :

  • Remove nss.conf from /etc/httpd/conf.d (this will cause mod_nss to not be loaded).

  • Uninstall/re-install your nss rpm modules. On re-installation a new certificate will be generated and your problem will go away for a few more years :

    rpm -e mod_nss
    rm /etc/httpd/alias/*
    yum install mod_nss
    service httpd restart

The Server-Cert is expired, checked by:

certutil -d /etc/httpd/alias -L -n Server-Cert

At the moment, mod_nss is disable by removing nss.conf from /etc/httpd/conf.d/.

dnf remove mod_nss
rm /etc/httpd/alias/*
dnf install mod_nss
systemctl restart httpd

the important is remove /etc/httpd/alias/* before reinstall it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.