Getting an error while trying to enable encryption:

[ERROR] SSL error: Unable to get private key from '/etc/mysql/ssl/nginx.key'
[Warning] Failed to set up SSL because of the following SSL library error: Unable to get private key



The key is generated like that:

openssl req -newkey rsa:4096 -nodes -keyout nginx.key -subj "/C=US/ST=California/L=Sacramento/O=MyOrg/OU=MyDev/CN=MyApp"

The openssl checks it fine.

I've tried to change permissions, owners, file names, moving to different directories, disabling SELinux (it's already disabled), looking at AppArmor logs (it doesn't block it), changing 'BEGIN/END PRIVATE KEY' to 'BEGIN/END RSA PRIVATE KEY'.

What's wrong with it?


Ok, apparently just changing 'BEGIN PRIVATE KEY' to 'BEGIN RSA PRIVATE KEY' isn't enough.

It must be properly converted from PKCS#8 to PKCS#1 Reference

openssl rsa -in /etc/mysql/ssl/nginx.key -out ~/nginx.key.rsa
| improve this answer | |
  • 1
    Why did I just search the Internet for an hour for this...thank you. – BaseZen Jun 1 '18 at 22:09
  • Mine needed this because it was originally generated by LetsEncrypt for my website. But Apache needed no conversion. – BaseZen Jun 1 '18 at 22:16

As a consolidation of my false leads that helped others:

  • POSIX mode bits and file owner: The mysql user must have read access to all SSL files via user or group privileges. This may mean chown mysql *.pem or adding ssl-private to mysql's groups. (https://serverfault.com/questions/417390/cannot-setup-mysql-ssl-unable-to-read-certificate)

  • AppArmor can cut off file access. You need something like /etc/mysql/** in /etc/apparmor.d/usr.sbin/mysqld. Check /var/log/kern.log and consider aa-complain /usr/sbin/mysqld to get errors rather than denials.(https://forums.mysql.com/read.php?26,393495,393636#msg-393636)

  • Malformatted file contents. SSL library is very bad at complaining accurately. Ensure the full key set works on, say, a web site.

  • The file is missing entirely. Again, in the error message there is no distinction made.

| improve this answer | |

Alternative answer not given by those above: There is a problem with the certificate itself, or the certificate chain, and not the private key. In our case, the certificate file contained the intermediate certificates in the authentication chain. The presence of these additional certificates caused MySQL to report the "Unable to get private key" error. This was found to be the case in MariaDB 5.5.64.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.