51

So I've been sent a new public cert to install on a server (.crt file). Done. Restart apache - "FAILED".

Error message:

[Tue Jan 11 12:51:37 2011] [error] Unable to configure RSA server private key 
[Tue Jan 11 12:51:37 2011] [error] SSL Library Error: 185073780 error:0B080074:
x509 certificate routines:X509_check_private_key:key values mismatch

I've checked the key values:

openssl rsa -noout -modulus -in server.key | openssl md5
openssl x509 -noout -modulus -in server.crt | openssl md5

and they DO match.

I've checked the paths in my ssl.conf file, and they ARE pointing to the correct files.

If I reinstate the old (expired) cert file, apache starts up ok, so it definitely doesn't like something about the new one.

It's a GeoTrust QuickSSL, and it came with an "intermediate.crt" that I'm supposed to use in place of the the "ca-bundle.crt" file that I was using before

SSLCertificateFile /etc/pki/tls/certs/www.domain.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/www.domain.com.key
SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt

Any ideas what I might be doing wrong? Any more info you need?

Thanks!

9 Answers 9

90

I also came across the same error. In my case I had to supply additional CA certificates in the verification chain. And instead of supplying the certificate and the key in separate files, I combined them in a .pem file.

However, when you do this, the order of the key and the certificate plus the intermediate one(s) is important. The correct order:

your private key
your certificate
(intermediate) CA certificate lowest in the hierarchy
other CA certificates higher in the hierarchy...
(intermediate) CA certificate highest in the hierarchy
6
  • 7
    I can't upvote you enough for this, the ordering bit is hardly mentioned anywhere and just saved me some significant trauma. Thanks :-) Commented Feb 21, 2014 at 10:12
  • 1
    +1, This put me down the right track. The problem was in my intermediate certificates file, though in my case, I did not have to them together to fix it. Turns out the problem for me was in the intermediate certificate bundle (gd_bundle_xxx.crt) file that GoDaddy provided our client. GoDaddy issues different "stock" versions of this file and somehow managed to send one that was incorrect for our key/crt combination. For GoDaddy, you can pull the different versions of their intermediate bundles from this repository: certs.godaddy.com/anonymous/repository.pki
    – bwright
    Commented Apr 24, 2014 at 20:02
  • Thanks! Intermediates after the cert, not before! Duh.
    – agrath
    Commented Mar 24, 2015 at 23:39
  • I had this same issue from key generated from an encrypted p12 file using open ssl. the resulting pem fils caused the error and this was the solution.
    – Jim
    Commented Mar 28, 2017 at 18:15
  • after i make a single bundle which includes :your private key, your certificate how do i use it in apache ? thank you Commented Nov 11, 2020 at 13:00
10

I had the same issue on one of my CentOS 6.5 servers recently and it was down to when I generated the KEY and CSR.

I have three sites running on this server in virtualhosts all with dedicated IPs and each site has its own SSL Certificate.

In a rush, when changing one of the certificates, I stupidly just followed the certificate provider's guide to gaining the CSR and installing it in Apache, and I was instructed to use the following command:

openssl req -new -newkey rsa:2048 -nodes -keyout domain-name-here.key -out domain-name-here.csr

After installing the new certificate I was then also facing Apache not starting and the same errors in /var/log/httpd/ssl_error_log:

[error] SSL Library Error: 185073780 error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

[error] Unable to configure RSA server private key

Now what I really should have done was check my .bash_history files, as I have successfully done this in CentOS many times before.

I should have run these two commands instead :

openssl genrsa -des3 -out domain-name-here.co.uk.key 2048

openssl req -new -key domain-name-here.co.uk.key -out domain-name-here.co.uk.csr

This then successfully generated the CSR and KEY, and I re-applied for the certificate using the newly gained CSR, then applied the new certificate and added the new key file and finally then Apache would start cleanly.

Also, just to note, after a little configuration we now score A+ in an SSL labs test.

3
  • Was trying to setup SSL for Apache HTTP Server. This answer works! Thanks! Commented Mar 18, 2016 at 2:59
  • 1
    The Certificate provider's method results in files that cause Apache to FAIL TO START WITHOUT INDICATING ANY ERRORS! MAJOR FAIL on Apache and Certicate provider's part. Tony's answer saved my day.
    – Andz
    Commented May 15, 2016 at 11:03
  • 1
    how did you "re-applied for the certificate using the newly gained CSR, then applied the new certificate and added the new key file" in terms of command line , would you please elaborate
    – kamal
    Commented Feb 7, 2017 at 11:12
8

When reissuing my Rapid SSL certificate (purchased through Namecheap) to deal with the Heartbeat bug, the new certificate was always issued against the private key used for the previous CSR request. After about the fifth reissue, pairing that with the private key used in the fourth reissue attempt made things work fine.

5
  • I used the same CSR and always got the right one on the second attempt.
    – hwilbanks
    Commented Apr 10, 2014 at 20:05
  • Same problem here for us as-well. It appears using rapidssl.com re-issue tool directly may be the "fix". Commented Apr 10, 2014 at 23:35
  • 4
    Update: Namecheap's tool is broken, use products.geotrust.com/geocenter/reissuance/reissue.do instead. I can confirm that does work correctly. Commented Apr 10, 2014 at 23:47
  • 1
    @MichaelPasqualone, I cannot thank you enough for your comment. I too can confirm Namecheap's tool is broken and the geotrust link does indeed work.
    – allejo
    Commented Apr 11, 2014 at 3:43
  • @MichaelPasqualone I want to echo the "Thanks" here. The GeoTrust link you provided works like it should. To others using the Namecheap tool, just throw away everything from those attempts and start anew with the above link. Use the "reissue" link on the left after getting the email link. Commented Apr 12, 2014 at 13:28
4

make sure all cert files are encoded using ANSI, not UTF-8.

For me all tests said: key, crt and csr do match, but the logs said X509_check_private_key:key values mismatch until I saw that one of the files was encoded in UTF-8.

1

In my case, I had two sites and two subtley different private keys:

nginx: [emerg] SSL_CTX_use_PrivateKey_file("/some/path/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

After I fixed that, the error message changed to mention /some/path/server.pem. Note the different private key, which only differed in file extension. I had 2 different sites encrypted with different keys (meaning I had fixed the first site but now needed to fix the second site). So be sure to read the error message carefully!

0

We also had the issue with NameCheap, the issued Cert matched the CSR that was used to generate the previous CERT. We let them know via their support page, and they said they already knew about the issue.

0

According the FAQ on the Apache website, the modulus and the public exponent for the cert and the key must match so that is a valid check.

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#verify

As you and others have already stated, work with the cert issuer

0

The trickiest bit in my case is setting up the SSLCACertificateFile. Once the certificate company issued our cert, alongside it we received two additional certs: an intermediate and a root certificate. Which one to use for SSLCACertificateFile? Both..

Here's what my certificate chain look like:

enter image description here

And for the SSLCACertificateFile I have to concatenate digicert_sha2_high_assurance_server_ca.crt and digicert.crt into one file in the mentioned order.

-1

Dynadot seem to have the same issues with the RapidSSL certificates they are re-issuing. I just received a non working certificate, which then triggered another issue with Apache, when that was fixed I found this question and answer here for the original problem, thanks for the information everybody. I shall be scrapping the RapidSSL Cert as I have some client compatibility issues with it anyway and purchasing a new one from AlphaSSL instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.