Fix Apache “Unable to configure RSA server private key”

Compare certificate and private-key public components, then inspect file paths, passphrases, and service access.

Guance Editorial Team 2026-10-27 3 min read Updated 2026-10-27

Illustration of encrypted network connections

Apache's private-key error can come from a mismatched certificate, an unreadable or malformed key, a wrong path, or a passphrase the service cannot obtain. Check the preceding error-log entries before deciding which file to replace.

Compare the public keys

Export both public keys in the same encoding. Run these commands in a scratch directory and require every command to succeed:

openssl x509 -in /etc/apache2/ssl/server.crt -pubkey -noout \
  -out cert-public.pem &&
openssl pkey -pubin -in cert-public.pem -outform DER -out cert-public.der &&
openssl pkey -in /etc/apache2/ssl/server.key -pubout -outform DER \
  -out key-public.der &&
openssl dgst -sha256 cert-public.der key-public.der

Equal digests mean the certificate contains the public key corresponding to that private key. Different digests mean the files do not belong together. This method works for RSA and EC keys; RSA modulus comparisons do not apply to EC.

An encrypted key prompts for its passphrase. Do not compare hashes of empty output from failed commands. The intermediate files above contain public material, not private key components.

If the key is missing, recover it from your controlled key store or backup. A CA generally does not retain a private key you generated. If it cannot be recovered, generate a new key and reissue the certificate.

Inspect each virtual host's paths

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/fullchain.pem
    SSLCertificateKeyFile /etc/apache2/ssl/server.key
</VirtualHost>

Check symlink targets, deployment timestamps, and every virtual host using the files. fullchain.pem should begin with the leaf certificate matching the key, followed by its intermediate certificates. Apache 2.4.8+ supports that chain in SSLCertificateFile; the separate SSLCertificateChainFile directive is obsolete there.

Validate file contents and key access

openssl x509 -in server.crt -noout
openssl pkey -in server.key -check -noout
ls -l /etc/apache2/ssl/server.key

PEM labels identify object types: certificates use BEGIN CERTIFICATE, while private keys may use BEGIN PRIVATE KEY, BEGIN ENCRYPTED PRIVATE KEY, or algorithm-specific labels. Common CRLF line endings and ordinary blank lines do not automatically corrupt PEM.

A privileged Apache startup commonly reads a root-owned key with mode 600. A different service identity needs an appropriately restricted arrangement. Check parent-directory traversal and mandatory access-control policy as well as the file mode. Do not expose private key content in tickets or logs.

Handle passphrases through the deployment

A matching encrypted key can still fail during unattended startup if Apache cannot obtain its passphrase. Review SSLPassPhraseDialog and the service's supported secret-delivery mechanism. Do not casually generate another unencrypted copy as a debugging shortcut.

Once the configuration test succeeds, reload Apache and confirm the endpoint serves the intended certificate. An HTTPS test in Guance can check the expected response with certificate verification enabled; it does not replace the predeployment key-match check.

References: Apache SSL directives and OpenSSL pkey.