1

I have created ssl certificates for my site from sslforfree.com

I try to enable SSL on my NGINX server as follows, unfortunately I receive an error message as you may see at the bottom:

/etc/nginx/sites-available/default

server {
    listen 80;
    server_name myserver.com;

    listen 443;
    ssl on;
    ssl_certificate /home/tolga/SSLcerts/ca_bundle.crt;
    ssl_certificate_key /home/tolga/SSLcerts/private.key;

ERROR message:

tail -f /var/log/nginx/error.log

2017/10/06 11:29:55 [emerg] 13813#13813: SSL_CTX_use_PrivateKey_file("/home/tolga/SSLcerts/private.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

What might e the problem??

  • 1
    There is a problem with the key.... Post the steps you took to produce the csr and key. Along with the steps once you had the key from the CA – Drifter104 Oct 6 '17 at 8:39
  • 1
    You have a mismatch between the private key and certificate. You are using the ca_bundle certificate instead of the SSL certificate issued for your domain. – RoseHosting Oct 6 '17 at 8:44
3

The error in your config is that you have only one server paragraph. The server tells everything that a single connection needs to know. When you want SSL then you need to put that in a separate server paragraph. Correct me if I'm wrong, but as far as I can remember (and using NginX for 3 years now) a single server paragraph can't listen on two different ports.

So your correct config would look like this if you also wish to redirect all HTTP to HTTPS:

server  {
        listen  80;
        server_name     myserver.com;
        return          301 https://myserver.com$request_uri;
}

server  {
        listen                  443 ssl;
        server_name             myserver.com.hu;

        ssl_certificate         /home/tolga/SSLcerts/ca_bundle.crt;
        ssl_certificate_key     /home/tolga/SSLcerts/private.key;

        root                    /var/www/html/com.myserver/public;

        error_log               /var/log/nginx/com.myserver/error.log;
        access_log              /var/log/nginx/com.myserver/access.log;

        index                   index.php;

        gzip  on;
        gzip_vary on;
        gzip_min_length 10240;
        gzip_proxied expired no-cache no-store private auth;
        gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
        gzip_disable "MSIE [1-6]\.";

        location..............
        location..............
        location..............
        location..............

}

Also some advice for the future:

  • Put your crt and key files into /etc/nginx/ssl/com.myserver.crt and /etc/nginx/ssl/com.myserver.key (simply cause it is better organised this way)

  • Enhance your security with the following code after ssl_ccertificate and before the root:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

ssl_dhparam /etc/nginx/ssl/dhparam.pem;

  • Create your dhparam.pem file with the following command:

    openssl dhparam -dsaparam -out /etc/nginx/ssl/dhparam.pem 4096

| improve this answer | |
  • 2
    "When you want SSL then you need to put that in a separate server paragraph. Correct me if I'm wrong, but as far as I can remember (and using NginX for 3 years now) a single server paragraph can't listen on two different ports." That's just plain simple wrong. Test for yourself. – gf_ Oct 6 '17 at 11:28
  • Will do and if it works, I might reconfigure my configs. Even tho I think this way is is more pretty and understandable. – Bert Oct 6 '17 at 11:50
  • 1
    "Even tho I think this way is is more pretty and understandable.": Sure. And it's also helpful if you want to redirect http to https. But this doesn't lead to "can't listen". It might be that people have different use cases, so claims like these aren't that helpful. – gf_ Oct 6 '17 at 11:51
1

I had 2 CRT files downloaded from sslforfree.com

In the nginx config, when I changed the certificate from ca_bundle.crt to certificate.crt problem is solved.

| improve this answer | |
  • 2
    Forget sslforfree, go to the source directly. Let's Encrypt – Bert Oct 6 '17 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.