Solved Renewing Certificate on Debian Nginx Issues

[SimonCC]

I am trying to replace the soon to expire certificate on our 3CX Debian system

I am copying files to /var/lib/3cxpbx/Bin/nginx/conf/Instance1

When I try to restart the Nginx server I see this error in the log below and the server does not start

SSL_CTX_use_PrivateKey_file("/var/lib/3cxpbx/Bin/nginx/conf/Instance1/mydomain-key.pem") failed (SSL: error:0906D06CEM routinesEM_read_bio:no start line:Expecting: ANY
PRIVATE KEY error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_fileEM lib)

I am using open ssl to extract my certificate and key from a pfx file. Generated from my Lets Encrypt wildcard certificate

I have read where Nginx needs to see the certificates in a certain order, which I have done as follows.

My Certificate
Intermediate
Root

Any clues please?

 

[edegan]

I followed this previously to renew ours - not a wildcard but a UCC - https://www.3cx.com/community/threads/renewing-certificate-for-3cx-v15-nginx-webserver.54243/

I did have an issue where I had to remove some lines from the top of the cert and key files once they were output from openssl so I deleted anything above and below the bits below so I just had these headers/footers and the code inbetween.

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

and

-----BEGIN ENCRYPTED PRIVATE KEY-----
-----END ENCRYPTED PRIVATE KEY-----

Hope this helps.

 

[AverageAs]

Hey mate

I do this fairly often

Download this tool to break the certificate into the different file types
https://www.paessler.com/tools/certificateimporter

It will output the file into 3 types.
prtg.crt
root.pem
prtg.key

Rename the root.pem into <Youroldcertname-crt.pem>
Rename the prtg.key into <Youroldcertname-key.pem>

From there you know what to do.

 

[SimonCC]

Thanks. I use PRTG and already had those files since use the same certificate on PRTG setup exported from the same pfx file.
Just tried and got exactly same error, so not sure what is different about my Debian install that causes it to reject these files.

I am trying to think back when I installed in the first place, I must have had to provide those files, so it must have work at install time

 

[SimonCC]

Thanks AverageAs

I have just run the Paessler tool again, and got it working this time!

I think my issue has been the order of the certificates, and the Paesller tool sorts this perfectly.

 

[AverageAs]

Thanks AverageAs

I have just run the Paessler tool again, and got it working this time!

I think my issue has been the order of the certificates, and the Paesller tool sorts this perfectly.

You are welcome, glad you got it sorted.