Apache fails to start with new ssl certificate

Question

I'm running RHEL 6.4 and my trusted certificate has expired recently, so I decided to renew it. I've obtained a new certificate from StartSSL. After downloading and putting the certificate file on the server, I specified the new certificate in httpd.d/ssl.conf.

/sbin/service httpd configtest

says Syntax OK, but

/sbin/service httpd restart

causes [FAILED] result with no error message. Where can I find the actual reason?

UPDATE:

[error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
[warn] RSA server certificate CommonName (CN) `www.mywebsite.com' does NOT match server name!?

these lines were found in error_log of particular viruatal host.

(www.mywebsite.com is substitution of real domain for conspiracy reason of course)

Are you using the correct key, the key you used to create the CSR that you send to startssl? If you are using your old key and new cert apache does fail to start. — squareborg, Mar 30 '14 at 21:20
only "[notice] caught SIGTERM, shutting down" in /var/log/httpd/error_log — heximal, Mar 30 '14 at 21:21
what if I used old key for producing csr? is it wrong way? is it necessary to genereate new private key for csr each time? — heximal, Mar 30 '14 at 21:24
No using the old key is fine. If that is what you did then its OK. — squareborg, Mar 30 '14 at 21:26
Thanks Michael, I've discovered new data for research in virtual host log. (the question is upated) — heximal, Mar 30 '14 at 21:46
This should be merged with http://serverfault.com/q/459275/87017 — Pacerier, Apr 15 '16 at 18:02

score 2 · Accepted Answer · answered Mar 31 '14 at 05:56

x509 certificate routines:X509_check_private_key:key values mismatch means that the private key you have specified does not match the public key in the certificate you have specified.

Make sure that you are referencing the correct key and certificate files in your configuration.

RSA server certificate CommonName (CN) 'www.mywebsite.com' does NOT match server name!? may be a sign that it is the wrong certificate that has been specified.

Apache fails to start with new ssl certificate

1 Answers1

Linked