折腾：
【未解决】Ubuntu部署已有Django项目
期间，nginx中配置：
server {
listen 80;
server_name asmp.xxx.com;
client_max_body_size 50m;
listen 443;
ssl on;
ssl_certificate /root/xxx/chained.pem;
ssl_certificate_key /root/xxx/xxx-ssl/2_asmp.xxx.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /root/xxx/xxx-ssl/1_asmp.xxx.com_bundle.crt;
...结果
# nginx -s reload
nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/xxx.conf:7
nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/xxx.conf:7
nginx: [emerg] SSL_CTX_use_PrivateKey("/root/xxx/xxx-ssl/2_
asmp.xxx.com.key
") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)结果报错
nginx: [emerg] SSL_CTX_use_PrivateKey key failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
好像针对于pem，用openssl去重新生成对应格式pem即可？
好像是应该改为：
ssl_certificate /path/to/nginx_bundle.crt; ssl_certificate_key /path/to/your.key;
此处是：
ssl_certificate /root/xxx/xxx-ssl/1_ asmp.xxx.com_bundle.crt; ssl_certificate_key /root/xxx/xxx-ssl/2_ asmp.xxx.com.key;
或许就可以了？
ssl_certificate /var/www/sslkey/cacert.pem; ssl_certificate_key /var/www/sslkey/privkey.pem;
那先去搞清楚：
对于之前的两个文件
1_asmp.xxx.com_bundle.crt
2_asmp.xxx.com.key
好像是阿里云中拿到的，针对于nginx的。
要搞清楚如何使用。
以及参考别人的配置中的
ssl_trusted_certificate
是用用来干啥的，是不是此处可以去掉的？
之前配置都没用到：ssl_trusted_certificate
nginx https ssl_trusted_certificate
“ssl_trusted_certificate，包含PEM格式的可信CA证书列表（顺序是子证书在上、父证书在下）,用于在开启ssl_stapling时验证客户端证书和OCSP Response.”
或许此处不开启 OCSP之类的stamping的东西，就不需要了
“Syntax:
ssl_trusted_certificate file;
Default:
—
Context:
http, server
This directive appeared in version 1.3.7.
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.
In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.”
改成：
listen 443; ssl on; # ssl_certificate /root/xxx/chained.pem; ssl_certificate 1_asmp.xxx.com_bundle.crt; ssl_certificate_key /root/xxx/xxx-ssl/2_asmp.xxx.com.key; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_timeout 10m; ssl_session_cache shared:SSL:10m; # ssl_stapling on; # ssl_stapling_verify on; # ssl_trusted_certificate /root/xxx/xxx-ssl/1_asmp.xxx.com_bundle.crt;
结果：
# nginx -s reload nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/xxx.conf:7 nginx: [warn] the "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /etc/nginx/conf.d/xxx.conf:7
貌似没问题了。
转载请注明：在路上 » 【已解决】nginx的ssl证书报错：emerg SSL_CTX_use_PrivateKey key failed SSL error 0B080074 x509 certificate routines X509_check_private_key key values mismatch