How to Fix Nginx SSL Certificate Error

In this tutorial, you'll learn about How to Fix Nginx SSL Certificate Error. We cover key concepts, practical examples, and best practices.

Nginx fails to start with SSL_CTX_use_PrivateKey_file("/etc/ssl/private/key.pem") failed or browsers show NET::ERR_CERT_COMMON_NAME_INVALID — the SSL certificate is missing, has wrong permissions, or does not match the domain name.

The Problem

$ sudo nginx -t
nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/private/example.key") failed
   (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

Step-by-Step Fix

Step 1: Check certificate and key match

# Compare certificate modulus with private key modulus
openssl x509 -noout -modulus -in /etc/ssl/certs/example.crt | md5sum
openssl rsa -noout -modulus -in /etc/ssl/private/example.key | md5sum

Both hashes must match. If they do not, your certificate and private key are from different pairs.

Step 2: Set correct file permissions

sudo chmod 644 /etc/ssl/certs/example.crt
sudo chmod 600 /etc/ssl/private/example.key

Step 3: Configure SSL in Nginx

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/example.crt;
    ssl_certificate_key /etc/ssl/private/example.key;
}

Step 4: Include intermediate certificates

# Concatenate full chain
cat example.crt intermediate.crt > fullchain.crt

ssl_certificate /etc/ssl/certs/fullchain.crt;

Step 5: Test the SSL configuration

openssl s_client -connect example.com:443

Prevention Tips

• Use Let's Encrypt with certbot for automated certificate management
• Set up certificate renewal monitoring with alerts
• Always use full certificate chains (server + intermediates)
• Keep private key permissions as 600 or 400

Common Mistakes with ssl certificate

1. Using return to exit a function early instead of wrapping a pure value in the monad
2. Mixing let bindings with <- bindings in do notation, producing type errors
3. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors

These mistakes appear frequently in real-world NGINX code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ