私钥格式错误

Question

I'm using nginx to set up SSL connections, but my keys aren't working.

When I restart nginx I get the following error:

Restarting nginx: nginx: [emerg] SSL_CTX_use_PrivateKey_file("/home/[user]/CC/[domain].com.key.pem") failed (SSL: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:Field=algorithm, Type=X509_ALGOR error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:Field=algor, Type=X509_SIG error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)

nginx.

I have the key from the original request, but it says the format is wrong. In order to check myself I made a new key in a different folder and that one works fine (asks for the password, etc.)

The top is the key I want to work, and the bottom is the key that does work. Do you notice anything different with the format? I have removed middle characters to keep security, but the format is unchanged.

$ cat [domain]com.key.pem 
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAALYmQ==
-----END ENCRYPTED PRIVATE KEY-----
$ cat 2/[domain]com.key.pem 
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+RM=
-----END ENCRYPTED PRIVATE KEY-----

Answer 1

This seems to arise when you have repeated unlockings in a short period of time, especially when you enter your passphrase incorrectly a few times. I think this might be a security policy that OpenSSL is enforcing about repeated unlocking of an unchanged certificate. Or maybe it's a cache issue. But marking the file as "changed" is enough to reset the (security?) cache:

$ touch /path/to/key.pem

Depending on what permissions you have on the key, you may have to use sudo .