2

I recently regenerated my SSL certificate, which I purchased from Gandi, using the following command:

openssl req -nodes -newkey rsa:2048 -sha256 -keyout server.key -out server.csr

This generates 2 files, server.csr and server.key I then upload the signing request to Gandi, who in exchange gives me my server certificate as well as an intermediate certificate. I then concatenate these.

cat my-cert-from-gandi.crt intermediate.crt > chained-certificate.crt

Then in my nginx config:

 ssl                 on;
 ssl_certificate     /etc/nginx/certificates/chained-certificate.crt;
 ssl_certificate_key /etc/nginx/certificates/server.key;

Then when I try to test this config (nginx -t) I receive the following output:

nginx: [emerg]
SSL_CTX_use_PrivateKey_file("/etc/nginx/certificates/server.key")
failed (SSL: error:0B080074:x509 certificate
routines:X509_check_private_key:key values mismatch)

The modulus of the server.key matches the modulus of server.csr. However the modulus of my-cert-from-gandi.crt does not match the modulus of my private key...

One potential hint here is that the intermediate certificate seems to have changed on Gandi's end since the last time I did this. Previously it contained a single BEGIN/END block, and now it contains two. Not sure if this means I have to do something different.

Any help is much appreciated.

  • 1
    It sounds like somewhere in the process either the csr/cert or private key have been swapped for a different one. – Håkan Lindqvist Jun 6 '15 at 19:52
2

Either you have downloaded the wrong signed certificate from your CA, or the CA has committed a bizarre error (and managed to corrupt your key, sign a different key, or something).

Your best course of action is to contact the CA and see if they will help you out, after you double-check you have downloaded the right signed certificate. They should revoke the one they signed and sign your CSR again.

This cannot have anything to do with the intermediate CA certificates.

  • 1
    Or they gave the CA the wrong CSR, or they are still using an old private key... (just filling in some other variations on the same theme) – Håkan Lindqvist Jun 7 '15 at 1:04
  • The problem was definitely on my end. I must have been pointing my config to an old certificate or I somehow corrupted the certificate in the process. That's what I get for debugging while sleep deprived. – nrj Jun 8 '15 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.