So I just got my certificate issued from Digicert, and since there was other unused/old files in /etc/ssl/ i marked and removed, and accidently also removed localhost.crt.

Now I cannot start my web server (only without SSL). How do i recreate this localhost.crt file? And would i need to make a new key and get my certificate from digicert reissued?

  • Are you sure it's not a self-signed certificate?
    – Itai Ganot
    Dec 2, 2014 at 14:28
  • Yes the certificate i want running is not self signed, its by digicert. But /etc/ssl/certs/ only contains the certificate from digicert and csr i genereated for it. But in order to start my webserver it requires localhost.csr which i removed?
    – Karem
    Dec 2, 2014 at 14:35
  • 5
    Restore it from your backup.
    – Sven
    Dec 2, 2014 at 14:43
  • 5
    Then the most important thing you can do today is put a backup system in place. Dec 2, 2014 at 17:18
  • 2
    This file (localhost.crt) is generated with the script /etc/pki/tls/certs/make-dummy-cert on Red Hat, CentOS, and derivatives. You should not need it after you configure your web server to use the DigiCert certificate, but I wanted to add this to the conversation. Dec 2, 2014 at 21:40

5 Answers 5


your ssl certificate issuer should provide you free replacement or reissue. Just go to digicert and ask them.

Generate new key files from server and reissue ssl. Make sure the new ssl should be SHA2 only.


There are two solutions to this issue:

1) You can regenerate the default self-signed certificate using OpenSSL:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/ssl/certs/localhost.crt

2) You can search the Apache config files and replace the self-signed cert with the new certificate.

This command will tell you which Apache config files reference the localhost.crt file:

grep -i -r localhost.crt /etc/httpd/

An example output of the above command might be this:

/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt

That tells us to look in /etc/httpd/conf.d/ssl.conf and update the SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile to their new DigiCert certificate files.

Please feel free to call DigiCert support at 1-801-701-9600 if you have any problems or questions.


The files /etc/pki/tls/certs/localhost.crt and /etc/pki/tls/private/localhost.key are created by the postinstall script of the mod_ssl package. You can find the CentOS 7 spec file here: https://git.centos.org/rpms/httpd/blob/c7/f/SPECS/httpd.spec (check the other branches for different CentOS versions). Here is the script from CentOS 7:

%define sslcert %{_sysconfdir}/pki/tls/certs/localhost.crt
%define sslkey %{_sysconfdir}/pki/tls/private/localhost.key

%post -n mod_ssl
umask 077

if [ -f %{sslkey} -o -f %{sslcert} ]; then
   exit 0

%{_bindir}/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 2048 > %{sslkey} 2> /dev/null

if [ "x${FQDN}" = "x" -o ${#FQDN} -gt 59 ]; then

cat << EOF | %{_bindir}/openssl req -new -key %{sslkey} \
         -x509 -sha256 -days 365 -set_serial $RANDOM -extensions v3_req \
         -out %{sslcert} 2>/dev/null

So if you delete both localhost.key and localhost.crt, and do yum reinstall mod_ssl, then the postinstall script will recreate them for you.

(I'm posting this answer because searching how to recreate /etc/pki/tls/certs/localhost.crt leads me here, but as others stated, if you got a cert signed by a CA, you don't need the localhost.crt and localhost.key files any more.)

  • I tried the reinstall on Fedora 27 but it did not create the package.
    – Mike S
    Aug 26, 2018 at 19:19
  • I had to create my own private key, as per akadia.com/services/ssh_test_certificate.html
    – Mike S
    Aug 26, 2018 at 19:38
  • Upvoted because it got me to understand how to create the keys on my system, even if I needed to type in a different series of commands.
    – Mike S
    Aug 26, 2018 at 20:50

I just had this same problem. There was no default localhost certificate for CentOS 8 so I ran this and it regenerated all the default certs.


Hope it helps someone else.


You can just reinstall ssl with following command.It will regenerate localhost.crt

yum -y install mod_ssl

  • sorry its yum -y reinstall mod_ssl Apr 23, 2020 at 2:10
  • The answer you have posted doesn't address the question. The question is looking to recover a certificate file issued by digicert that has been accidentlly deleted. Apr 23, 2020 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.