I'm in the process of moving my website to another server, and after moving the SSL key and certs and recreating the same Apache config, I encounter the following in the error logs at the time of Apache servie restart (domain anonymized):

[Sun May 24 22:21:05.579373 2015] [ssl:emerg] [pid 9777] AH02561: Failed to configure certificate, check /etc/ssl/certs/example.com.crt
[Sun May 24 22:21:05.579407 2015] [ssl:emerg] [pid 9777] SSL Library Error: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
AH00016: Configuration Failed

It also prevents access on both :80 and :443. I've verified that the files are in the right spot and everything (SSL at least) is configured as it was on the old server. What am I missing here?

Here's a snippet from sites-available/default-ssl.conf (domain name anonymized):

SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
SSLCertificateChainFile /etc/ssl/certs/bundle.crt

New server specs: Debian 8 (old one had Debian 7), stock Apache 2.4.10.

Some more potential clues:

# openssl x509 -noout -modulus -in /etc/ssl/certs/example.com.crt | openssl md5
unable to load certificate
(stdin)= d41d8cd98f00b204e9800998ecf8427e
# openssl x509 -noout -modulus -in /etc/ssl/private/example.com.key | openssl md5
unable to load certificate
140331629921936:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE
(stdin)= d41d8cd98f00b204e9800998ecf8427e
# file /etc/ssl/private/example.com.key
/etc/ssl/private/example.com.key: PEM RSA private key
# file /etc/ssl/certs/example.com.crt
/etc/ssl/certs/example.com.crt: PEM certificate
  • That's an unusual way to check the certificate. Try instead openssl x509 -noout -text -in /etc/ssl/certs/example.com.crt | more. – Jenny D May 25 '15 at 13:25
  • Is SELinux or AppArmor enabled on the server? If so, what are the rules for /etc/ssl/certs? – Jenny D May 25 '15 at 13:26
  • The certificate seems corrupt, according to the "unable to load certificate" message, despite the correct BEGIN CERTIFICATE line. The key should be checked with openssl rsa, and the error message provides a hint that the command you used expects a certificate not a key. – eel ghEEz Jun 28 '16 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.