NGINX SSL: error:0200100D:system library:fopen:Permission denied

Question

I have been stuck on this for ages and I'm hoping someone can offer some advice.

Trying to install a new SSL certificate on a site. On running nginx -t i get the following error:

nginx: [emerg] BIO_new_file("/etc/nginx/ssl/mysite_com/mysite_com.crt") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/nginx/ssl/mysite_com/mysite_com.crt','r') error:2006D002:BIO routines:BIO_new_file:system lib)
nginx: configuration file /etc/nginx/nginx.conf test failed

Now I have set the owner/group on the mysite_com.crt to the same as the files that were in the previous config which pass the nginx test fine. I have also set the permissions to the same. Even setting the file permissions to 777 temporarily to test gave the same error. I also tried creating a /ssl/ directory in the root of the partition with 777 and still the same error. I have set the owner to http which is the webserver user on this machine and nothing.

I'm completley stumped. Any suggestions?

You need to check each element of the path, not only the filename. Each directory must have `rx` rights for the user under which your `nginx` process runs. — Patrick Mevzek, May 28 '17 at 08:21
this worked for me I found this answer https://serverfault.com/a/540544 — Alex028502, Jan 27 '21 at 18:06

score 3 · Answer 1 · answered May 26 '17 at 17:01

3

There is only one suggestion, you don't have enough rights for access file /etc/nginx/ssl/mysite_com/mysite_com.crt. When you start nginx -t under your account, nginx started with your permissions and couldn't get access to this files. There is two ways how to fix this issue without changing anything. First one - run nginx -t under root account or trough sudo to test configuration, second one - run nginx -t under http account to see how nginx start in real environment. But if you would like to make changes, you could add your user to group http and try to run nginx -t.

answered May 26 '17 at 17:01

Alexander Tolkachev

4,608
3
14
23

Unfortunately everything on this server has to be done under sudo su as the ssh account has been locked down quite tightly. I will try running nginx -t under the http user to see if they gives me any luck. – Craig May 26 '17 at 17:13
@Craig have you disabled SELinux? – Alexander Tolkachev May 26 '17 at 17:15
I did read another post suggesting sestatus -v which just came back with command not found. – Craig May 26 '17 at 17:21
@Craig what Linux you use? – Alexander Tolkachev May 26 '17 at 17:25
Excellent question, I'm waiting for that answer myself. I did cat /proc/version and /etc/*-version and couldn't find any clues. With any luck when I find out it will give me a clue to what's going on. – Craig May 26 '17 at 17:33
@Craig try `cat /etc/*release*` – Alexander Tolkachev May 26 '17 at 17:34
As it turns out it appears to be a Synology Device of some kind. Build 15101. Any quirks that this distribution has? – Craig May 30 '17 at 12:36

score 0 · Answer 2 · answered Aug 21 '21 at 12:18

It took me a few hours to figure it out, so it might be helpful for someone else: if you see error:0200100D:system library:fopen:Permission denied and permissions are correct: check apparmor. Message in /var/log/kern.log:

type=1400 audit(1629546067.301:14345): apparmor="DENIED" operation="open" profile="..." name="..." pid=704726 comm="..." requested_mask="r" denied_mask="r" fsuid=0 ouid=0

To fix correct corresponding profile in /etc/apparmor.d/

NGINX SSL: error:0200100D:system library:fopen:Permission denied

2 Answers2