The Uploaded Server Key Does Not Match With Certificateendreply.crt Certificate

What Is a Individual Key?
Finding your Private Key when y'all created the CSR in-browser
Finding your Private Key on Dissimilar Servers or Command Panels
- Linux-Based (Apache, Nginx, LightHttpd)
- Windows Operating Systems
- Mac OS 10
- Tomcat
- cPanel
- WHM
- Plesk
- Synology NAS DSM
- Webmin
- VestaCP
- DirectAdmin
- Webuzo

What Is a Private Cardinal?

You've received your SSL Document, and now you need to install it.

Firstly, let's get through some basics. Public Central Infrastructure (PKI) security is about using two unique keys: the Public Central is encrypted within your SSL Certificate, while the Private Key is generated on your server and kept secret.

All the information sent from a browser to a website server is encrypted with the Public Key and gets decrypted on the server-side with the Private Key. Together the central pair keeps communication secured, and i key will not work without the other.

How do I get it?

The Private Fundamental is generated with your Document Signing Request (CSR). The CSR is submitted to the Document Authority correct subsequently you lot actuate your Certificate. The Private Central must be kept safe and secret on your server or device because afterwards you'll need information technology for Certificate installation.

Can I generate a new Private Key for my Document if I lose the old one?

Yes. You lot tin generate a new Private Central and CSR, or use the automatic CSR and key generation during Document reissue (this selection is available for all Certificates except for the Multi-Domains).

What does the Private Primal look like?

Information technology looks like a cake of encoded data, starting and ending with headers, such as —–BEGIN RSA PRIVATE KEY—– and —–Cease RSA Individual Fundamental—–.

Y'all may not become to see this code when generating your CSR. Usually, it gets generated in the groundwork with the CSR and is automatically saved on your server. The system also fills the corresponding field automatically during the installation of your Document in some command panels, such as cPanel.

The fashion this works varies depending on your spider web server, control panel, or any other tools used for CSR generation. Select the one that applies to you in the following department for specific guidance.

Finding your Individual Key when you created the CSR in-browser

Generating the Individual Primal in your browser is an option for all SSL certificates except for multi-domain certificates. If you have a multi-domain SSL, you lot should have generated the CSR on your server, so skip to the section on finding your Individual Key on different servers and control panels.

If you chose to create your CSR in-browser during SSL activation, the Private Key is generally downloaded as a cypher file to your figurer'southward "Downloads" folder past default. Alternatively, if you changed your browser settings to save downloaded files to a different folder, it should exist saved there.

The file name will consist of your domain proper name, the word "key", and the file extension ".zip". For instance, for a website chosen example.com, the file name would be "example_com_key.nothing".

If you can't find the Private Primal in the previously mentioned folders, use your reckoner'south search function and enter the file name (i.eastward., example_com_key.zip). If yous however can't find the Private Key, you will need to get your SSL reissued. Considering the in-browser CSR generation method creates the Private Central straight on your device, there'due south no manner of restoring it if it's lost. This is why it'southward essential to save your Private Key and back it up if you cull this method.

Finding your Private Key on Unlike Servers or Command Panels

Linux-based (Apache, NGINX, LightHttpd)

Normally, the CSR/RSA Private Key pairs on Linux-based operating systems are generated using the OpenSSL cryptographic engine and saved as files with ".key" or ".pem" extensions on the server.

But no specific extensions are mandatory for text files in Linux, so the key file may have any proper noun and extension, or no extension at all.

If you remember the whole proper name of the primal file or at least part of information technology, you can utilize the following command in your panel to find the file and its directory:

sudo detect / -proper name 'filename.key'

The slash symbol in this command implies that the search begins from the root directory of the server. This way you accept more file options to view. The name of the file in between the single quotation marks should be the role of the name that you remember. To search for the file past extension, enter "*.key" to view all the files with the ".key" extension on your server.

Tip: often the proper name of the file corresponds to the domain proper noun information technology was generated for eastward.g. "domain_tld.key" or "domain.tld.pem".

Hither'due south another useful command that lets you search files by their content:

grep -r --exclude-dir=log --exclude-dir=ssh --exclude=*history -I -l -e '-----BEGIN Private*' -e '-----Brainstorm RSA*' -e '-----Begin EC*' [search_start_folder] 2> /dev/nothing

This command will return the absolute path to the Individual Fundamental file if it's located on your server.

Windows Operating Systems (IIS, Commutation, Small Business server)

Windows servers don't let you view the Private Key in manifestly text format. When you import your Certificate via MMC or IIS, the Private Cardinal is bound to it automatically if the CSR/Key pair has been generated on the same server.

If you need to obtain the Private Key to install your Document on a different server, you can export the key in a countersign-protected PFX (PKCS#12) file. To exercise that, open the MMC Certificates snap-in tools post-obit these steps:

Win+R > mmc.exe > OK > File > Add/Remove Snap-in > Certificates > Add together > Calculator business relationship > Next > Local figurer > End > OK

Adjacent, get to Certificate Enrollment Requests >> Certificates (if you haven't completed the Document request yet). If you've washed that, you'd select Personal >> Certificates, then right-click the Certificate >> select All Tasks >> Consign. The Export wizard will open up, and give you lot instructions. You can find more detailed instructions here.

Once that's washed, you will see the .pfx file containing your Certificate, CA-Bundle, and Private Key. To extract the key, utilise this tool. Choose the PKCS12 to PEM option, then upload the file and enter your chosen countersign.

Mac OS X

The Keychain tool in the Server application of Mac Bone 10 won't allow you to access the Individual Key via the graphic user interface. Instead utilize the Last, by opening /etc/certificates/ directory and clicking the file.

Its name should be something like "*.primal.pem". And the terminal commands to open up the file are: cd /etc/certificates/ , then ls , and sudo nano test.primal.pem .

Note: to bank check if the Individual Key matches your Certificate, go here. Then paste the Certificate and the Private Key text codes into the required fields and click Match.

Tomcat

If your Tomcat SSL connector is configured in JSSE style, the Private Primal must be in a password-protected keystore file with a .jks or .keystore extension. This file, dissimilar most other cases, is created earlier the CSR. To extract the Individual Key, you'll need to convert the keystore into a PFX file with the post-obit command:

keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -deststoretype PKCS12 -srcalias <jkskeyalias> -srcstorepass <jkspassword> -srckeypass <keypassword> -deststorepass <newp12password> -destkeypass <newkeypassword>

Tips:

"Keystore.jks" should be replaced with your actual keystore proper name,
"keystore.p12" volition be the name of the PKCS12 file you volition receive,
<jkskeyalias>, <jkspassword> and <keypassword> are the alias (key and keystore passwords that were entered during keystore generation),
<jkskeyalias>, <jkspassword> and <keypassword> should be replaced with your JKS file alias, its password, and Individual Key countersign.
<newp12password> and <newkeypassword> should be replaced with the passwords you prepare for your new PKCS12 file and the Private Key.

After the PKCS12 file is generated, you can convert it to a PEM file with separated CRT, CA-Bundle and Fundamental files using this tool. Alternatively, use the post-obit command in the terminal:

openssl pkcs12 -in keystore.p12 -nocerts -nodes -out individual.key

"Private.key" can be replaced with any fundamental file title you like.

cPanel

SSL/TLS Manager

The simplest mode to get the appropriate key used during SSL installation is reflected in the below picture:

Alternatively, you lot can find the Private Key in the Private keys section of the SSL/TLS Manager, which tin be located in the cPanel principal menu. You volition meet all the Private Keys ever generated in your cPanel. To view the lawmaking of the key, click View & Edit. If there are several keys in that menu, y'all tin can copy each of them to find a match with your Certificate code by using this tool.

File manager

On the homepage of your cPanel, click File manager. Find the folder named "ssl" in the folder tree to the left (see screenshot). That folder volition contain another folder named "keys". This key binder also contains all the keys e'er generated in your cPanel.

WHM

WHM stores your Private Keys and CSR codes in the SSL Storage Manager menu. On the homepage, click SSL/TLS >> SSL Storage Manager. To view the Private Key, click the magnifier icon next to the relevant central in the Primal column.

Plesk

Click Domains > your domain > SSL/TLS Certificates. You'll see a page similar the one shown below. The key icon with the message "Private key part supplied" ways there is a matching cardinal on your server.

To go it in plain text format, click the proper name and scroll downward the page until y'all see the key code. Alternatively, click the green arrow icon on the right. This will download a PEM file, containing your Private Cardinal, Document, and CA-Bundle files (if they were previously imported to the server). The files tin can be opened in any text editor, such as Notepad.

Synology NAS DSM

When generating a CSR in Synology DSM, the Private Key is provided to y'all in a zip file on the last pace. The fundamental code is contained within a server.key file, that tin can be opened with a text editor, such equally Notepad.

Webmin

Webmin works as a graphic user interface (GUI) on acme of the command-line interface. There is also a file manager called Filemin, that you can employ to browse the server file system and find your Private Key file. Alternatively, become to Others > Command Vanquish and run the discover or grep control, which you tin observe in the Linux Operating Systems section above.

VestaCP

Your Private Fundamental needs to be saved during CSR generation, equally information technology volition not be available via the graphic user interface.

That said, yous may exist able to retrieve your Private Fundamental via SSH. It is saved every bit a temporary file in the "/tmp" binder. The path to the file will look something similar this: "/tmp/tmp.npAnkmWFcu/domain.com.key".

Notation: the files in the /tmp directory are deleted every time your server is rebooted, so this is not a safe identify to store your Private Central.

To become the path to your primal file, use this Linux command:

find /tmp -type f -name "domain.com.key"

Where you see "domain.com", replace this with the actual domain name you generated the CSR for.

The path to your primal file can also be found using the grep command:

grep -r -I -fifty -e '-----BEGIN Individual*' -e '-----Brainstorm RSA*' /tmp 2> /dev/null

DirectAdmin

In the upwardly-to-appointment version of DirectAdmin, your Private Fundamental is saved on the server. Admission information technology in the "Paste a pre-generated Certificate and primal" field during installation.

If that section is empty, it may mean the CSR and fundamental were generated elsewhere, or the key was not saved in DirectAdmin due to a glitch. If a glitch happened, endeavour retrieving the key via SSH. Usually, it is saved in this directory:

/usr/local/directadmin/data/users/<user>/domains/<domain>.central

Note: <user> and <domain> are your DirectAdmin details.

Webuzo

On the homepage, observe the SSL management department past clicking the Individual Keys button. This will display a list of all the Private Keys generated in Webuzo. To see the key code, click the pencil icon to the right under the Selection cavalcade, every bit shown in the screenshot beneath:

To sum up, ways to find your Private Key fully depend on the interface of the webserver where you generate the CSR. If the methods described higher up did non assistance you find the Private Key for your certificate, the merely solution would be to generate a new CSR/Private Key pair and reissue your document, and to make sure that the cardinal is saved on your server/local computer this time.

storksomard1972.blogspot.com

Source: https://www.ssls.com/knowledgebase/how-can-i-find-the-private-key-for-my-ssl-certificate/