Skip to content

Infra / Ops

Potential Pitfall of StartSSL's NGINX Settings: PEM_read_bio:bad end line

Diagnosing and fixing the PEM_read_bio:bad end line error nginx throws when a StartSSL certificate chain isn't assembled correctly.

1 min read
  • ssl
  • nginx
  • debugging

Nginx Logo (view full size, opens in a new tab)

Today while I was setting up a StartSSL SSL certificate for this site I got an error from Nginx that the SSL PEM_read_bio had a bad end line.

(SSL: error:0906D066:PEM routines:PEM_read_bio:bad end line)

Upon further research I found that this is a result of the following command:

cat ssl.crt sub.class1.server.ca.pem ca.pem > /etc/nginx/conf/ssl-unified.crt

When this is run, it concatenates the files incorrectly, as seen below:

-----END CERTIFICATE----------BEGIN CERTIFICATE-----

To fix this, we simply need to separate these two lines, ensuring we leave 5 -'s on each side of the statements. When completed, it should look like this:

-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----

With this fix made, we can restart NGINX and it should load correctly now.

sudo service nginx restart
Tag