Geek Answers Handbook

Haproxy: mismatches between the private key and the certificate downloaded from the PEM file

I am trying to use a certificate signed for another server. I have both a private key and a certificate.

My PEM file order:

subject=/C=***/L=*****/O=**********/CN=********* issuer=/C=***/O=*****Inc/CN=********Secure Server CA -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- subject=/C=US/O=******** Inc/CN=********* SHA2 Secure Server CA issuer=/C=US/O=********* Inc/OU=*********/CN=******** Global Root CA -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- subject=/C=US/O=********* Inc/OU=***********/CN=*********** Global Root CA issuer=/C=US/O=********* Inc/OU=************/CN=******** Global Root CA -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----

When I tried to deploy it to my haproxy, I got this error.

 [ALERT] 188/141626 (2322) : parsing [/etc/haproxy/haproxy.cfg:32] : 'bind *:443' : inconsistencies between private key and certificate loaded from PEM file ................ [ALERT] 188/141626 (2322) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg [ALERT] 188/141626 (2322) : Proxy 'www-https': no SSL certificate specified for bind '*:443' at [/etc/haproxy/haproxy.cfg:32] (use 'crt'). [ALERT] 188/141626 (2322) : Fatal errors found in configuration. Errors in configuration file, check with haproxy check.

And my haproxy version:

 HA-Proxy version 1.5.2 2014/07/12 Copyright 2000-2014 Willy Tarreau < w@1wt.eu >

I can run my haproxy with a self-signed certificate. Why does this inconsistency arise? I am sure that the private key belongs to the certificate.

I try for hours, but I can not find the reason.

Please, help! Thanks!

+7
ssl haproxy
source share
1 answer

The order of certificates in your file is incorrect. It seems that you first place an intermediate certificate (i.e. Secure Server CA ), which is expected to be a server certificate. The order of certificates should be:

  • server certificate
  • server private key (no password)
  • intermediate certificate 1
  • intermediate certificate 2

In fact, this is not so important when you put the secret key. However, the order of certificates is strictly necessary to order from the leaf to the root, that is, first the server certificate, then the intermediate, then the parent. Basically, you first put the server certificate, then its signer, then its subscriber, ...

See the documentation for more information.

+16
source share

More articles:


All Articles