I use certbot to generate ssl cert for my domain.

Then I use the following commands to copy the content to clipboard

cat ./letsencrypt/live/mycompany.com/cert.pem |pbcopy
cat ./letsencrypt/live/mycompany.com/privkey.pem |pbcopy

and paste into Google App Engine's "Add a new SSL certificate" dialog box.

However the private key is rejected due to 'The private key you've selected does not appear to be valid.'

I replaced the content with 'zzzz'

(I have replaced the content with 'zzzz')

How can I convert the certbot output into the right format?

Also I do not know exactly what format and roles are those certbot generated files are in.


2 Answers 2


I find out I can use openssl to convert the format

openssl rsa -in ./letsencrypt/live/mycompany.com/privkey.pem -out ./letsencrypt/live/mycompany.com/privkey.pem.rsa.key


To add to @Anthony Kong's answer...

What format are those certbot generated files in, and what roles do they perform?

The following are all PEM files [info], which store the various different peices of information to allow the certificate to be used.


  • cert.pem

    This is the issued certificate

  • chain.pem

    This is the set of certificates that go from a trusted root down to the cert before the issued one

  • fullchain.pem

    This is the set of certificates that go from a trusted root down to the issued one

  • privkey.pem

    This is the private key for the issued certificate


Imagine CA B is trusted by root A, and uses intermediate C to issue a certificate D.

The trust path would look like this

 A == Trusted root
\ /
 B == Issuing CA
\ /
 C == Intermediate Certificate
\ / 
 D == Issued certificate

In this case, the files would contain:

  • cert.pem

    The certificate of D

  • chain.pem

    The certificates of A,B,C

  • fullchain.pem

    The certificates of A,B,C,D

  • privkey.pem

    The private key of D

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .