Forum OpenACS Q&A: nsssl error

Hi,

I've been using a self-signed certificate with nsssl with no issues.

However, am getting an error when trying a CA signed certificate:

Error: nsssl: private key load error [error:0906D06C:PEM routines:PEM_read_bio:no start line]

I'm trying letsencrypt.org's certificate with its acme standard certificate renewal process. (Pretty neat concept.)

letsencrypt provides a cert.pem, chain.pem fullchain.pem and privkey.pem.

fullchain.pem contains cert.pem and chain.pem

So in nsd's config.tcl section for nssl:
ns_param certificate ${serverroot}/etc/certs/or97.net/fullchain.pem

Searching around, the issue might be related to openssl not tolerating a cert file saved in double-byte Unicode.

Does nsssl have this limitation?

Any suggestions on how to fix?

To rule out any permissions issue, the fullchain.pem was tried in the same name, location and with same permissions as the self-signed certificate. The error has not changed.

The self signed certificate contiues to work.

Benjamin, thanks for posting that. With your explanation, plus this hint on StackOverflow that certificate order matters, I got nsssl working for me. In one file, I put my certificate, my private key, and then my vendor's CA cert, in that order. Initially I had the CA cert first, which broke things.