NGINX 上的 SSL 证书无法加载 [lnmp vhost add 绑定域名后 Nginx 无法启动问题.]
原因: 是nginx无法找到ssl证书文件,因为证书文件的存放路径有问题
1 | systemctl restart nginx.service |
1. 重启Nginx时报错如下:
1 2 3 4 5 6 7 8 9 10 11 12 13 | Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ nginx[16189]: nginx: [emerg] cannot load certificate "/usr/local/nginx/conf/ssl/www.tokoler.com/fullchain.cer": BIO_new_file() failed (SS Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ systemd[1]: nginx.service: control process exited, code=exited status=1 Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ systemd[1]: Failed to start The NGINX HTTP and reverse proxy server. -- Subject: Unit nginx.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit nginx.service has failed. -- -- The result is failed. Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ systemd[1]: Unit nginx.service entered failed state. Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ systemd[1]: nginx.service failed. Feb 09 10:39:22 iZj6c0q4b3lxkav5hc1s7aZ polkitd[647]: Unregistered Authentication Agent for unix-process:16177:228470 (system bus name :1.85, object path /org/freedesktop/Policy |
2. 由上图就可以看到nginx报错.
1 2 3 4 | nginx: [emerg] cannot load certificate "/usr/local/nginx/conf/ssl/www.tokoler.com/fullchain.cer": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/usr/local/nginx/conf/ssl/www.tokoler.com/fullchain.cer','r') error:2006D080:BIO routines:BIO_new_file:no such file) nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed Reload Nginx...... nginx: [emerg] cannot load certificate "/usr/local/nginx/conf/ssl/www.tokoler.com/fullchain.cer": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/usr/local/nginx/conf/ssl/www.tokoler.com/fullchain.cer','r') error:2006D080:BIO routines:BIO_new_file:no such file) |
3. 查看存放路径:
1 2 | cd /usr/local/nginx/conf/ssl/ ls |
从上面可以发现所有 www.tokoler.com 要改成 www.tokoler.com_ecc
4. 修改前的路径
1 2 | cd /usr/local/nginx/conf/vhost vi www.tokoler.com.conf |
5. 修改后的路径
1 2 | ssl_certificate /usr/local/nginx/conf/ssl/www.tokoler.com_ecc/fullchain.cer; ssl_certificate_key /usr/local/nginx/conf/ssl/www.tokoler.com_ecc/www.bndstone.com.key; |
6. 修改后问题解决