I recently regenerated my SSL certificate, which I purchased from Gandi, using the following command:
openssl req -nodes -newkey rsa:2048 -sha256 -keyout server.key -out server.csr
This generates 2 files,
server.key I then upload the signing request to Gandi, who in exchange gives me my server certificate as well as an intermediate certificate. I then concatenate these.
cat my-cert-from-gandi.crt intermediate.crt > chained-certificate.crt
Then in my nginx config:
ssl on; ssl_certificate /etc/nginx/certificates/chained-certificate.crt; ssl_certificate_key /etc/nginx/certificates/server.key;
Then when I try to test this config (
nginx -t) I receive the following output:
nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/certificates/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
The modulus of the
server.key matches the modulus of
server.csr. However the modulus of
my-cert-from-gandi.crt does not match the modulus of my private key...
One potential hint here is that the intermediate certificate seems to have changed on Gandi's end since the last time I did this. Previously it contained a single
BEGIN/END block, and now it contains two. Not sure if this means I have to do something different.
Any help is much appreciated.