Question

我已经在Gandi上更新了我的证书：

sudo openssl genrsa -des3 -out mywebsite.com_encrypted.key 4096

sudo openssl req -new -key mywebsite.com_encrypted.key -out mywebsite.com.csr

cd /etc/nginx/ssl/
sudo nano mywebsite.com.crt # > pasted the Gandi certificate in this file

sudo wget https://www.gandi.net/static/CAs/GandiStandardSSLCA.pem

sudo cat GandiStandardSSLCA.pem >> mywebsite.com.crt

sudo openssl rsa -in mywebsite.com_encrypted.key -out mywebsite.com.key

sudo chown root:root mywebsite.com.key
sudo chmod 400 mywebsite.com.key

使用旧版证书一切都运行良好，但由于我使用新证书更新配置，这是我的登录nginx。我无法重启：

Nginx日志：

2015/05/12 20:53:03 [emerg] 7515#0: SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/mywebsite.com.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

流程有什么问题？

nginx的配置没问题。

这是我的nginx配置：

ssl on;
ssl_certificate /etc/nginx/ssl/mywebsite.com.crt;
ssl_certificate_key /etc/nginx/ssl/mywebsite.com.key;

Answer 1

I have no idea what you are trying to achieve. It looks like you replaced the key in /etc/nginx/ssl/mywebsite.com.key, leaving the original certificate /etc/nginx/ssl/mywebsite.com.crt unchanged (the mywebsite.com.crt certificate is still bound to the original key - and you cannot change that - public key is an integral part of X509 certificate). This is exactly what openssl is trying to tell you - you are trying to use a certificate with different private key that was originaly created with.

BTW: I also have no idea why you created a certificate request (along with the new key) and then left it unused (without actually using it to create new certificate).

无法重新启动nginx https证书例程私钥错配

1 个答案: