Ssh – Apache2 SSL Certificate error

apache-2.2debiansshsslssl-certificate

I bought a Cert. at checkdomain.
They gave me two files a .crt and a .ca-bundle and .key.
I moved them to "/etc/ssl/g/".
I enabled SSL with "a2enmod ssl" and restarted the apache by using "sudo service apache2 restart", no error till then.

Then I edited default-ssl.conf:

<VirtualHost *:443>
ServerName mrgrimod.de
DocumentRoot "/var/www/html"

SSLEngine on
SSLCertificateFile    /etc/ssl/g/g.crt
SSlCertificateKeyFile /etc/ssl/g/g.key
</VirtualHost>

Then I tried to restart the apache by using "sudo service apache2 restart" but it fails to restart and spills out that error: Job for apache2.service failed. See 'systemctl status apache2.service' and 'journalctl -xn' for details.

The apache error log contained these lines:

 Fri Mar 30 17:03:50.143429 2018] [ssl:error] [pid 10598:tid 3074262784] AH02579: Init: Private key not found
[Fri Mar 30 17:03:50.143530 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Fri Mar 30 17:03:50.143557 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Fri Mar 30 17:03:50.143578 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Fri Mar 30 17:03:50.143599 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Fri Mar 30 17:03:50.143620 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Fri Mar 30 17:03:50.143640 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Fri Mar 30 17:03:50.143660 2018] [ssl:error] [pid 10598:tid 3074262784] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)
[Fri Mar 30 17:03:50.143674 2018] [ssl:emerg] [pid 10598:tid 3074262784] AH02311: Fatal error initialising mod_ssl, exiting. See /var/log/apache2/error.log for more information
[Fri Mar 30 17:03:50.143704 2018] [ssl:emerg] [pid 10598:tid 3074262784] AH02564: Failed to configure encrypted (?) private key server1.server1.de:443:0, check /etc/ssl/ssl.key/server.key

Best Answer

You could use the command apachectl -t to check for any syntax error's before restart the apache service. The command should output Syntax OK if no error's are found.

You should include more details regarding your .conf files before we could decide what's the error.

Regardless, this is a configuration example for enabling SSL support:

<VirtualHost *:443>
ServerName example.com
DocumentRoot "/var/www/html"

SSLEngine on
SSLCertificateFile /etc/httpd/ssl/mycert.pem
SSlCertificateKeyFile /etc/httpd/ssl/mycert.pem
SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!aNULL:!MD5
</VirtualHost>

To enable SSL, the configuration file must include at minimal the following options:

SSLEngine On: turn support for SSL.

SSLCertificateFile: The location of the singed certificate you were provided.

SSlCertificateKeyFile: The key file that was generated on your system.

Also, a required approach by many browser to justify the request's to your site, is to include the chain file -the one called bundle- using the configuration option SSLCertificateChainFile

And I would suggest the following reference's: Apache how-to : https://httpd.apache.org/docs/2.4/en/ssl/ssl_howto.html

Related Topic