NGNIX 1.6.2 on Debian8: Won't start after adding SSL

Question

I can't figure out even the text of the error I get from starting it

● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
   Active: failed (Result: exit-code) since Fri 2015-06-05 16:52:14 UTC; 8s ago
  Process: 17285 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /run/nginx.pid (code=exited, status=0/SUCCESS)
  Process: 17273 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 17386 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 17275 (code=exited, status=0/SUCCESS)

Jun 05 16:52:14 ip-172-31-33-65 systemd[1]: Starting A high performance web server and a reverse proxy server...
Jun 05 16:52:14 ip-172-31-33-65 nginx[17386]: nginx: [emerg] BIO_new_file("/etc/ssl/www_mydomain_me.pem") failed (SSL: error:02001002:system libr...ch file)
Jun 05 16:52:14 ip-172-31-33-65 nginx[17386]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jun 05 16:52:14 ip-172-31-33-65 systemd[1]: nginx.service: control process exited, code=exited status=1
Jun 05 16:52:14 ip-172-31-33-65 systemd[1]: Failed to start A high performance web server and a reverse proxy server.
Jun 05 16:52:14 ip-172-31-33-65 systemd[1]: Unit nginx.service entered failed state.
Hint: Some lines were ellipsized, use -l to show in full.

My additional "server" configuration in the "default" under "sites-available" is:

server {

        listen  443 ssl;
        ssl on;
        ssl_certificate /etc/ssl/www_example_com.pem;
        ssl_certificate_key /etc/ssl/www_example_com.key;

        access_log      /var/www/laravel/access.log;
        error_log       /var/www/laravel/error.log;

        server_name example.com;

}

If I remove this block, my NGNIX restarts correctly and serves our web app via port 80. My goal is to support HTTPS and even redirect any HTTP call into HTTPS. I don't want non secure traffic on my website.

We just got our EV SSL certificate from Symantec today but I just can't get the NGNIX server to accept it or its configuration.

As the message told you, use `systemctl status nginx -l` to see the full log lines. Otherwise they are truncated and useless. — Michael Hampton, Jun 05 '15 at 20:07

score 3 · Accepted Answer · answered Jun 05 '15 at 17:54

First thing is to check if the path you specified is correct

$ ls /etc/ssl/www_mydomain_me.{pem,key}

If yes, check if the permission is proper for them. If not, update as below:

$ chown root:root /etc/ssl/www_mydomain_me.{pem,key} $ chmod 600 /etc/ssl/www_mydomain_me.{pem,key}

edit: the first answer is similar to mine. sorry, around same time.

score 0 · Answer 2 · answered Jun 05 '15 at 17:51

I am going to assume that the full text of the relevant ellipsed error code should be:

 error:02001002:system library:fopen:No such file

Either the path to your file is incorrect, or the permissions on /etc/ssl/www_mydomain_me.pem are incorrect. The ownership be root:root, unless you use the ssl_cert group, and the permissions should be 600 at the most.

NGNIX 1.6.2 on Debian8: Won't start after adding SSL

2 Answers2