0

I am trying to specify an SSL certificate to Apache webserver, but I am getting some strange errors. Unfortunately, I don't know that much about SSL. Can someone kindly help me out.

Error log in /var/log/apache2/error.log :

 [Mon Jan 11 16:32:23 2016] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jan 11 16:32:23 2016] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Mon Jan 11 16:32:23 2016] [error] SSL Library Error: 67710980 error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Mon Jan 11 16:32:23 2016] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jan 11 16:32:23 2016] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Mon Jan 11 16:34:18 2016] [error] Init: Private key not found
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218640442 error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 67710980 error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218529960 error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jan 11 16:34:18 2016] [error] SSL Library Error: 218595386 error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error

I have configured SSL in this way :

Listen 443
<VirtualHost _default_:443>
JkMount /* loadbalancer
SSLEngine on
SSLCertificateFile /path/to/domainname.crt
SSLCertificateKeyFile /path/to/domainname.key
</VirtualHost>

The files provided by SSL providers are .ca-bundle, .p7c, .combined, .crt, .csr, .key, .key.pem.

How can Apache then understand SSL. Kindly let me know. Thank you.

Update

As per Tim's suggestion, I did call cat on the files, they looked as follows :

cat file_name.crt :

---BEGIN CERTIFICATE---
Random Characters
---END CERTIFICATE--

cat file_name.key

 ---BEGIN CERTIFICATE---
    Random Characters
    ---END CERTIFICATE--

cat file_name.key.pem

Bag Attributes
    friendlyName: domain_name.com
    localKeyID: some integers here
Key Attributes: <No Attributes>
-----BEGIN PRIVATE KEY-----
    Random Characters
-----END PRIVATE KEY-----
2

The wrong tag is the best indicator you have. Apache assumes that your keys and certificates look like this. Check the files you reference meet these criteria.

Certificate

-----BEGIN CERTIFICATE-----
xxxxxxx
-----END CERTIFICATE-----

Key

-----BEGIN PRIVATE KEY-----
xxxxxxx
-----END PRIVATE KEY-----

If you are pointing to a file with additional metadata like this you will get the above error.

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            xx:yy:zz...
    Signature Algorithm: sha1WithRSAEncryption
    ................
-----BEGIN CERTIFICATE-----
xxxxxx
-----END CERTIFICATE-----
  • Hi, I checked the .crt file with keytool -printcert -v -files filname.crt . Is that the correct way, if yes, then I don't see the certificate in the way you specified. – We are Borg Jan 11 '16 at 15:57
  • @weareborg you want to just cat the files – Tim Brigham Jan 11 '16 at 15:58
  • The /path/to/domainname.crt and /path/to/domainname.key files should be inspected to ensure they only contain the certificate and key respectively. Use your favourite editor of cat them in your terminal. – HBruijn Jan 11 '16 at 16:24
  • @HBruijn : It starts and ends properly as Tim had indicated. Like this --Start certificate-- random_characters --End Certificate-- . All in Block letters. Just one thing I noticed, even if I cat the key, it says Begin Certificate, instead of Begin Key. Is that normal? – We are Borg Jan 11 '16 at 16:26
  • I have added what I see in the certificate in the main post. Kindly have a look.. :-) – We are Borg Jan 11 '16 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.