0

I recently did a series of upgrades to a server running a web application:

  • PHP 5.3 to PHP 5.5
  • Apache 2.2 to Apache 2.4

To be more precise, the upgrade required that Apache, PHP, and all mods (including mod_ssl) be uninstalled, and that newer versions be installed.

After the installation updating ssl.conf with the path to my cert/pk as it was before the update, when trying to start Apache, I am getting the following 3 errors in ssl_error_log:

AH02561: Failed to configure certificate [theserver]:443:0, check [/path/to/me/crt]

SSL Library Error: error:0906D066:PEM routines:PEM_read_bio:bad end line

SSL Library Error: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib

My first guess as to why, is that the re-installation changed the environment in such a way that the cert is no longer valid on the server. I can reissue, but in my case it means some down time in my production environment and re-configuring a load balancer, which I'd like to avoid if this is not the case.

Is it likely that the cert needs to be resigned/reissued, or am I looking at another error here?

2

No, the certs doesn't need to be resigned/reissued, you can the one you have. I think the problem is in the path to the certificate, OR in the permission you need to access it.

| improve this answer | |
1

Indeed the answer is no, I did not need to resign. It was a formatting issue with the cert.

This is strange as the cert was working before. My guess is that the newer version of ModSSL is more picky about the crt's format.

Here's what fixed it:

Originally:

LASTLINEOFCERTCODE=-----END CERTIFICATE-----
[NEWLINE]

Changed To:

LASTLINEOFCERTCODE=
-----END CERTIFICATE-----
[NEWLINE]
| improve this answer | |
  • 1
    "Originally" is not valid to begin with, and should have been rejected all along. – Michael Hampton Nov 17 '15 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.