在 AWS Ubuntu(18.04) Nginx 上安装 SSL 证书（从 Godaddy 购买）

Question

I am trying to Install SSL Certificate(Purchased from Godaddy) on AWS EC2 Ubuntu (18.04) Nginx server I combined main crt and bundle crt into one chained crt file. I edited nginx config file for my domain as follows:

 server {
    listen 443 ssl ;
    listen [::]:443 ssl ;
    server_name xxx.com;

    ssl_certificate /etc/nginx/ssl/domain.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/domain.key;

    ...

 }

When I restart nginx I am getting error as follows:

SSL_CTX_use_PrivateKey_file failed
 faiine:Expecting: ANY PRIVATE KEY error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
 failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: ANY PRIVATE KEY error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/domain.key") failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: ANY PRIVATE KEY error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)

Can you pls help any one facing the issue and fixed.

Thanks AUS

Answer 1

Sounds like you have the wrong key format. It says no start line . Usually keys encoded in PEM look like:

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIJnDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIPSbRcLCz160CAggA
[...]
JKpDZaoOa3UW8BlWYkpQkw==
-----END ENCRYPTED PRIVATE KEY-----

It's complaining about not finding that start line. The line containing -----BEGIN ENCRYPTED PRIVATE KEY----- . So it sounds like you have the wrong format for your key.

A way simpler method of getting this working is using Let's Encrypt . The certificate is free. They have a plugin that automatically sets up nginx for you.

Answer 2

I got it working by opening generated-private-key.txt with notepad++ and selected Encoding->ANSI and saved it. Then I uploaded it to my ssl path.

It worked and nginx started without any issue.

Thanks AUS