2

I have an Apache 2.2 web server running on CentOS 6.6. I have a certificate and key file that functions when the files are in this directory:

SSLCertificateFile "/etc/pki/tls/private/certs/mycert.crt"
SSLCertificateKeyFile "/etc/pki/tls/private/mycert.key"

but it fails when the same files are in a different directory

drwxr-xr-x. 2 root root 4096 Apr  8 16:41 ssl

SSLCertificateFile "/etc/ssl/mycert.crt"
SSLCertificateKeyFile "/etc/ssl/mycert.key"

The apache error logs contain

[error] Init: Private key not found

SELinux is disabled. What would cause behavior like this?


UPDATE

The permissions for the files are the same in both directories:

-rw-r--r--  1 root root 2253 Apr  8 16:40 mycert.crt
-rw-------  1 root root 1675 Apr  8 16:40 mycert.key
6
  • permissions of the files? are they readable by the user httpd? – natxo asenjo Apr 8 '15 at 18:01
  • Have a closer look : your key file is only readable by root – krisFR Apr 8 '15 at 18:07
  • 1
    It is absolutely correct that the key file is only readable by root. It is recommended in the Apache manual to do it like that (in fact they would even remove the writable permission for root). – faker Apr 8 '15 at 18:16
  • The permissions for the ssl directory should be 700, and the certs/keys themselves should be 600. Owned by root:root. – Hyppy Apr 8 '15 at 18:21
  • 11
    That is a convention. If you follow the conventions, you will have a happy life. If you don't, then you have to deal with the things that break, most of which aren't obvious. And for the love of all that is good stop disabling SELinux! – Michael Hampton Apr 8 '15 at 18:24
-1

apache runs under apache user, not root, and you limited acces to root user only maybe? So try "chown apache /etc/ssl/mycert.key". It is very obvious, but you did not mention it, so just suggesting.

1
  • 3
    Apache runs as root initially and then drops privileges, so it can initially read the key file. It needs to do this to be able to bind to privileged ports such as 80 and 443. – bodgit Mar 21 '19 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.