LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 06-07-2021, 10:58 AM   #1
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 192

Rep: Reputation: Disabled
trouble with changing crt


Rhel 7.9 server
I have an issue with a crt. It comes from godaddy.
When I replace the existing, expired cert(which I've done before), I receive this error.

Mon Jun 07 10:43:18.476221 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476287 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Mon Jun 07 10:43:18.476312 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476335 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Mon Jun 07 10:43:18.476359 2021] [ssl:error] [pid 124791] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Mon Jun 07 10:43:18.476380 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476401 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

I receive the 3 kiles, 2 crt and 1 pem. Normally, I just name them to match the current ones, so I don't have to change the ssl.conf
I've converted the pem to a .key, but I can't seem to clear this error. I have other certs for other sites, and changing them in the same way has not been an issue.
So, maybe it's a problem with the cert from godaddy? Or maybe the pem to key conversion is the problem?
 
Old 06-07-2021, 02:19 PM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,142

Rep: Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264
Print the public cert contents with:

Code:
openssl x509 -in cert.pem -noout -text
Post the output here if you have trouble interpreting it. Don't post your private key. If it gets the same errors when doing this command, then the cert is likely not the right format.
 
1 members found this post helpful.
Old 06-07-2021, 02:38 PM   #3
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 192

Original Poster
Rep: Reputation: Disabled
Not sure what you might be looking for, but there are no errors present in the output, that I can see. Maybe reconverting the .pem into a .key? Perhaps the first conversion wasn't actually successful?
 
Old 06-07-2021, 02:46 PM   #4
jefro
Moderator
 
Registered: Mar 2008
Posts: 21,987

Rep: Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627Reputation: 3627
https://www.ssl247.co.uk/kb/ssl-cert...routine-apache

Two ideas.
 
1 members found this post helpful.
Old 06-07-2021, 03:56 PM   #5
dc.901
Senior Member
 
Registered: Aug 2018
Location: Atlanta, GA - USA
Distribution: CentOS/RHEL, openSuSE/SLES, Ubuntu
Posts: 1,005

Rep: Reputation: 370Reputation: 370Reputation: 370Reputation: 370
Quote:
Originally Posted by vinmansbrew View Post
Rhel 7.9 server
I have an issue with a crt. It comes from godaddy.
When I replace the existing, expired cert(which I've done before), I receive this error.

Mon Jun 07 10:43:18.476221 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476287 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
[Mon Jun 07 10:43:18.476312 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476335 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=RSA)
[Mon Jun 07 10:43:18.476359 2021] [ssl:error] [pid 124791] SSL Library Error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib
[Mon Jun 07 10:43:18.476380 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Mon Jun 07 10:43:18.476401 2021] [ssl:error] [pid 124791] SSL Library Error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error (Type=PKCS8_PRIV_KEY_INFO)

I receive the 3 kiles, 2 crt and 1 pem. Normally, I just name them to match the current ones, so I don't have to change the ssl.conf
I've converted the pem to a .key, but I can't seem to clear this error. I have other certs for other sites, and changing them in the same way has not been an issue.
So, maybe it's a problem with the cert from godaddy? Or maybe the pem to key conversion is the problem?
Not sure if you tried these things already:
If you copied those files from Windows box, it may have introduced CR/LF.
Compare the hash values with md5sum or sha1 - whatever option you have - to make sure files are the same...
 
Old 06-07-2021, 04:17 PM   #6
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,142

Rep: Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264
Maybe explain what conversion you're doing and what the 3 files from GoDaddy are. You should have generated a private key that you saved and a CSR for GoDaddy. They should send you the certificate and a certificate chain. They should not have your private key.
 
Old 06-07-2021, 04:25 PM   #7
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 192

Original Poster
Rep: Reputation: Disabled
I get 3 files from GD. a crt and pem file named the same, and a crt that is the intermediate crt. I get these in a zip, which I have extracted on my win10 box, that I then copy to to whichever server it may be fore. Then I use openssl to convert the pem to a key. I rename the 3 files to match what the current names are. This way I don't need to change the ssl.conf file. I've done this for others, no problem.
This has been the only server that's been an issue. So, I wonder if I got a bad set from GD.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
trouble ahead, trouble behind....trouble with mplayer Goonie Linux - Software 3 07-02-2003 02:29 AM
Redhat 9 Switching between CRT And LCD NEONLUG Linux - Hardware 2 04-27-2003 08:33 PM
secure crt help Zac2003 Linux - Software 5 02-22-2003 02:25 PM
CRT Monitor with S-Video Input Freaksta Linux - Hardware 2 02-15-2003 01:15 AM
How to force my display refresh rate to 85 @ 1024x768 which Dell CRT can? AnnoD04 Linux - Software 2 02-08-2002 07:07 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 11:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration