I downloaded certificated for my website using letsencrypt:

letsencrypt -d crackerscreed.me --manual --preferred-challenges dns certonly

The process was successful but the site I want to implement these certificates on is expecting .key file for private key. There are many solution which tells the solution using openSSL:

When I tried:

openssl rsa -outform der -in /etc/letsencrypt/live/crackerscreed.me/privkey.pem -out /etc/letsencrypt/live/crackerscreed.me/privkey.key

The site popped an error saying:

Invalid KEY format encountered. Your file doesn't seem a valid key! Please, upload valid key file.

and when I tried with x509 instead of RSA,

openssl x509 -outform der -in /etc/letsencrypt/live/crackerscreed.me/privkey.pem -out /etc/letsencrypt/live/crackerscreed.me/privkey.key
unable to load certificate

OpenSSL popped an error saying:

unable to load certificate 140343522624768:error:0906D06C:PEM routines:PEM_read_bio:no start line:../crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

What do I do now? Is there a way to properly convert the file? If not, can I revoke these certificates and create new ones and somehow ask letsencrypt to provide me certificates directly as .key file instead of .pem file?

  • openssl x509 is for a certificate, not a key. openssl rsa produces a raw PKCS1 RSAPrivateKey; are you sure your site wants that? I don't know any sw besides OpenSSL that supports it, and OpenSSL sw usually uses PEM not DER. There is no standard for what a .key file is but one of the two forms of PKCS8, or possibly PKCS12, seems much more likely; Microsoft PVK is also possible. Find out what your site wants -- exactly. – dave_thompson_085 Nov 1 '17 at 3:45
  • The extension of the file by itself is meaningless. What does the content looks like, at least its beginning? – Patrick Mevzek Apr 23 '18 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.