0

I am brand new to creating a CSR manually in Apache (Windows server), as well as installing the resulting certificate. However, here is what I have done.

First, I generated the CSR by using the following command...

openssl req -new -newkey rsa:2048 -nodes -keyout [domainname].key -out [domainname].csr -config "C:\Apache24\conf\openssl.cnf"

then I stepped through and answered the prompts. I did not enter anything for Passphrase, I simply hit enter and skipped it. not sure if that is what caused the issue I'm having or not.

After the CSR was generated, I uploaded it to my SSL vendor and then downloaded the resulting certificate .zip file. The .zip file though only contains 2 files. One being a random string filename .crt and one being a bundle filename .crt file. There is no .key file in the zip at all.

I then added the following lines to my VirtualHosts file in Apache.

<VirtualHost *:443>
    ServerAdmin webmaster@mydomain.com
    DocumentRoot "c:/sites/mydomain.com"
    ServerName mydomain.com
    ServerAlias www.mydomain.com
    SSLEngine on
    SSLCertificateFile "c:\ssl\mydomain.com\randomstringfilename.crt"
    SSLCACertificateFile "c:\ssl\mydomain.com\bundlefilename.crt"
</VirtualHost>

But when I try to start Apache service, it bombs and I get the following in the error.log file.

[Tue Nov 21 12:13:08.096246 2017] [ssl:emerg] [pid 10496:tid 500] AH02577: Init: SSLPassPhraseDialog builtin is not supported on Win32 (key file C:/ssl/mydomain.com/randomstringfilename.crt)
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] AH02564: Failed to configure encrypted (?) private key mydomain.com:443:0, check C:/ssl/mydomain.com/randomstringfilename.crt
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Tue Nov 21 12:13:08.097246 2017] [ssl:emerg] [pid 10496:tid 500] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

I'm thinking this has something to do with the fact that I do not have a private.key file to add to the VirtualHosts with SSLCertificateKeyFile statement, but I'm not sure because I've never done this before.

What do I need to do?

Thank you!

2

openssl req -new ... -keyout [domainname].key ...

When you ran that command that created the CSR, it created a key saved to [domainname].key hopefully you still have it somewhere. If not, just re-generate a new CSR, and re-key. Most CAs will let you generate a new key/cert without any additional charges. This time pay close attention to where your key and csr is saved to.

1
  • THANK YOU!!!! I have the .key file and after adding it to my Virtual Hosts and restarting Apache - all works as expected!
    – Phil
    Nov 21 '17 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.