10

I am trying to enable ssl on a server using a certificate from 123-reg but I keep getting this error:

nginx: [emerg] SSL_CTX_use_certificate_chain_file("/opt/nginx/conf/cleantechlms.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib)

This is my nginx config:

server {
  listen 443;
  server_name a-fake-url.com;
  root /file/path/public;   
  passenger_enabled on;

  ssl on;
  ssl_certificate /opt/nginx/conf/cleantechlms.crt;
  ssl_certificate_key /opt/nginx/conf/cleantechlms.key;
 }

I have tried setting my crt and key to full file permissions but there is no difference.

My crt file is the crt I was issued concatenated with the ca crt.

Update

I have tried copying both the keys in sperate files and then running 'cat mykey.crt >> ca.cert'

Also I tried manually copying the keys into the same file.

Any ideas?

Alex
  • 405
  • 1
  • 5
  • 14
  • Your `/opt/nginx/conf/cleantechlms.crt` is broken somehow. How did you create it? Could you post all steps you did? – VBart Dec 04 '12 at 20:21
  • In `cleantechlms.crt` you want to have only your public certificate without key and chain certificates from your ca. If you open it in text editor you should see just --BEGIN-CERTIFICATE-- blocks.. – week Dec 05 '12 at 00:11

2 Answers2

6

Thanks for your help, this is how I solved it:

  • Copy the certificates into a text editor to ensure there is no whitespace (I had already done this)

  • Ensure the beginning and end certificate statements are on there own line and have the same number of '-' at each end.

  • Ensure each line has 64 chars (except the last line)

Alex
  • 405
  • 1
  • 5
  • 14
  • I also got the error when the .cer file contained only the top level cert and not the entire bundled / chain of certs (intermediate and root ca) – radtek May 07 '15 at 15:20
0

I ended up with same exception and got it fixed by adding private key(x.509 + privatekey at the end) in the same pem file (pem format). I think its because I used to have the same format and validating the config with "nignx -t".

Hope it helps.

BalaMurugan Mahendran
  • 1