0

When adding SSL certificate to the page and trying use command:

This is the configuration I'm using:

server {
        listen 80 default_server;
        server_name piotrzak.design;
        rewrite ^/(.*) https://piotrzak.design/$1 permanent;
        listen [::]:80 default_server;



        server_name piotrzak.design;
        ssl_certificate /home/pz/piotrzak.design.chained.pem;
        ssl_certificate_key /home/pz/piotrzak.design.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

        # SSL configuration
        #
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;

        #
        # Note: You should disable gzip for SSL traffic.
        # See: https://bugs.debian.org/773332
        #
        # Read up on ssl_ciphers to ensure a secure configuration.
        # See: https://bugs.debian.org/765782
        #
        # Self signed certs generated by the ssl-cert package
        # Don't use them in a production server!
        #
        # include snippets/snakeoil.conf;

        root /home/pz/Potfolio-v.1.0.1;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name piotrzak.design;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to displaying a 404.
                autoindex on;
                try_files $uri $uri/ =404;
                root /home/pz/Portfolio-v.1.0.1;

                proxy_pass http://167.99.140.31:85;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }

Where should i find solution for this type of error?


Edit:

1) Input: systemctl -l status nginx

Output:

 nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Fri 2018-08-17 19:51:40 UTC; 2h 11min ago
  Process: 16205 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=1/FAILURE)
  Process: 16481 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
 Main PID: 1637 (code=exited, status=0/SUCCESS)

2) Input : sudo nginx -t

Output :

nginx: [emerg] BIO_new_file("/home/sammy/piotrzak.design.chained.crt") failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/home/sammy/piotrzak.design.chained.crt','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed

Thank you, this command show me where is error, i need to correct path, when i did it the next error is:

1) Input : sudo nginx -t

Output :

nginx: [emerg] PEM_read_bio_X509_AUX("/home/pz/piotrzak.design.chained.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: configuration file /etc/nginx/nginx.conf test failed

Edit #2:

Hmm, currently certificate provides 4 files:

a) CSR

b) Private key

c) Intermediate certificate (Here are 4 keys)

d) SSL certificate

So, creating :

domain.key - private key

domain.pem - certificate

intermediate.pem - copy here one key from intermediate

4
  • Did you actually read the output from that command? The logs underneath that section you screenshoted should help shed light on the problem. However, it is more helpful if you copy and paste the text into your question as an edit rather than post a screenshot. It's hard to isolate text in a screenshot if we want to share it back to you for any reason like debugging. (Fair warning and disclaimer: I maintain the NGINX packages in Ubuntu, so if I seem like a know-it-all, I actually do know a lot about the package because I help maintain it)
    – Thomas Ward
    Aug 17, 2018 at 19:52
  • That's not the information we need from the error to find the problem. Run systemctl -l status nginx, and copy/paste all of the output from this command into your question as an edit. That should contain log information which can help debug the problem you're having.
    – Thomas Ward
    Aug 17, 2018 at 20:12
  • The exit code is generic for the service. Please run sudo nginx -t and verify the results of the configuration file. Post the results here. Aug 17, 2018 at 20:26
  • This sounds like a great time to read digicert.com/csr-ssl-installation/nginx-openssl.htm Aug 18, 2018 at 0:06

1 Answer 1

0

The message Expecting: TRUSTED CERTIFICATE indicates a problem with the certificate file at ("/home/pz/piotrzak.design.chained.crt")

The fact that your crt file has 'chained' in the name looks like the problem.

I suggest changing the file name from crt to pem, and see if NGINX likes that better.

If that fails, does your chained file contain only the public certificate and the intermediate certificate? If not, I would try a pem with only those two certs.

3
  • When i changing intermediate & piotrzak.design.crt it produce this type of error: nginx: [emerg] PEM_read_bio_X509_AUX("/home/pz/piotrzak.design.chained.pem") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE) nginx: configuration file /etc/nginx/nginx.conf test failed
    – Piotr Żak
    Aug 17, 2018 at 23:54
  • I believe something is wrong with your chained certificate file. I'd recommend rebuilding it with only the Public Certificate, Intermediate Certificate and Root Certificate. If that still fails, then RobotHumans link above that details the certificate setup from start to finish... It would be a good idea to run through that process again.
    – Dre
    Aug 21, 2018 at 0:36
  • ok, i run this process again, use other provider and it's work
    – Piotr Żak
    Jan 17, 2020 at 1:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .