I have been stuck on this for ages and I'm hoping someone can offer some advice.

Trying to install a new SSL certificate on a site. On running nginx -t i get the following error:

nginx: [emerg] BIO_new_file("/etc/nginx/ssl/mysite_com/mysite_com.crt") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/nginx/ssl/mysite_com/mysite_com.crt','r') error:2006D002:BIO routines:BIO_new_file:system lib)
nginx: configuration file /etc/nginx/nginx.conf test failed

Now I have set the owner/group on the mysite_com.crt to the same as the files that were in the previous config which pass the nginx test fine. I have also set the permissions to the same. Even setting the file permissions to 777 temporarily to test gave the same error. I also tried creating a /ssl/ directory in the root of the partition with 777 and still the same error. I have set the owner to http which is the webserver user on this machine and nothing.

I'm completley stumped. Any suggestions?

  • You need to check each element of the path, not only the filename. Each directory must have rx rights for the user under which your nginx process runs. – Patrick Mevzek May 28 '17 at 8:21

There is only one suggestion, you don't have enough rights for access file /etc/nginx/ssl/mysite_com/mysite_com.crt. When you start nginx -t under your account, nginx started with your permissions and couldn't get access to this files. There is two ways how to fix this issue without changing anything. First one - run nginx -t under root account or trough sudo to test configuration, second one - run nginx -t under http account to see how nginx start in real environment. But if you would like to make changes, you could add your user to group http and try to run nginx -t.

  • Unfortunately everything on this server has to be done under sudo su as the ssh account has been locked down quite tightly. I will try running nginx -t under the http user to see if they gives me any luck. – Craig May 26 '17 at 17:13
  • @Craig have you disabled SELinux? – Alexander Tolkachev May 26 '17 at 17:15
  • I did read another post suggesting sestatus -v which just came back with command not found. – Craig May 26 '17 at 17:21
  • @Craig what Linux you use? – Alexander Tolkachev May 26 '17 at 17:25
  • Excellent question, I'm waiting for that answer myself. I did cat /proc/version and /etc/*-version and couldn't find any clues. With any luck when I find out it will give me a clue to what's going on. – Craig May 26 '17 at 17:33

After given permission as sudo chmod -R 777 still if you are getting above error then run nginx -t as root user,if you didn't get any error then run sudo nginx -t as any user in server(the user who have sudo privilages) this trick worked for me

  • Using chmod -R 777 blindly IS a security hole. Why would a .crt file need to be executable? – bgtvfr Sep 27 at 9:07
  • Yes, chmod -R 777 is security hole, we shouldn't use that one. For the first time testing purpose we can use chmod -R 777 later if everything working fine, then we should convert to chmod -R 755 . – PRAVEEN KUMAR R Sep 30 at 5:55
  • Using chmod -R 755 blindly IS a security hole. Why would a .crt file need to be executable? :) – bgtvfr Sep 30 at 14:09
  • We can use chmod -R 440 instead of chmod -R 755.Thank you – PRAVEEN KUMAR R Oct 1 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.