nginx config_error ai_generated true

nginx: [emerg] SSL_CTX_use_certificate_chain_file("/etc/nginx/ssl/cert.pem") failed (SSL: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag)

ID: nginx/ssl-pem-format-error

Also available as: JSON · Markdown · 中文
90%Fix Rate
87%Confidence
1Evidence
2024-01-08First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.24.0 active — — —
nginx 1.22.1 active — — —
nginx 1.18.0 active — — —
nginx 1.20.2 active — — —

Root Cause

The certificate file is in DER format but nginx expects PEM format, or the PEM file is corrupted with extra whitespace or binary data.

generic

中文

证书文件是 DER 格式，但 nginx 期望 PEM 格式，或者 PEM 文件包含额外空格或二进制数据而损坏。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate

Workarounds

  1. 95% success Convert the certificate from DER to PEM using OpenSSL: 'openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM' then replace the file. 
    Convert the certificate from DER to PEM using OpenSSL: 'openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM' then replace the file.
  2. 85% success If the file is PEM but corrupted, regenerate it by concatenating the certificate chain in correct order: 'cat server.crt intermediate.crt root.crt > /etc/nginx/ssl/cert.pem' and ensure no extra spaces. 
    If the file is PEM but corrupted, regenerate it by concatenating the certificate chain in correct order: 'cat server.crt intermediate.crt root.crt > /etc/nginx/ssl/cert.pem' and ensure no extra spaces.
  3. 90% success Validate the PEM file with 'openssl x509 -in /etc/nginx/ssl/cert.pem -text -noout' to check for parsing errors before reloading nginx. 
    Validate the PEM file with 'openssl x509 -in /etc/nginx/ssl/cert.pem -text -noout' to check for parsing errors before reloading nginx.

中文步骤

  1. Convert the certificate from DER to PEM using OpenSSL: 'openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM' then replace the file.
  2. If the file is PEM but corrupted, regenerate it by concatenating the certificate chain in correct order: 'cat server.crt intermediate.crt root.crt > /etc/nginx/ssl/cert.pem' and ensure no extra spaces.
  3. Validate the PEM file with 'openssl x509 -in /etc/nginx/ssl/cert.pem -text -noout' to check for parsing errors before reloading nginx.

Dead Ends

Common approaches that don't work:

  1. 95% fail

    The error is about file parsing, not trust chain validation.

  2. 99% fail

    The error explicitly mentions the certificate file path; the key is a separate directive.

  3. 100% fail

    The file content is invalid; a restart will reproduce the same error.