Apache Broke on Boot (Because of Course It Did)

Restarting Apache and hitting SSL Library Error: 185090057 error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib? You are not alone. This error means Apache cannot parse one of your certificate files because the PEM structure is broken. The fix is almost always a formatting issue in the certificate text itself.

Cause

The error is triggered by an incorrect certificate format. Common culprits include:

• Missing or extra dashes around the BEGIN CERTIFICATE and END CERTIFICATE markers
• Stray whitespace, extra line breaks, or invisible characters (often introduced by copy-pasting from a web page or email)
• A certificate that was exported in DER (binary) format instead of PEM (text) format

Resolution

1. Open the affected certificate file in a plain text editor such as vi, nano, or Notepad.
2. Verify that the file begins with exactly five dashes followed by BEGIN CERTIFICATE and ends with END CERTIFICATE followed by exactly five dashes.
3. Confirm there are no leading or trailing spaces, blank lines, or extra characters before the first dash or after the last dash.
4. Save the file and restart Apache with systemctl restart httpd (or apachectl restart on older systems).

Expected Format

A valid PEM certificate file should look exactly like this:

-----BEGIN CERTIFICATE-----
[base64-encoded data]
-----END CERTIFICATE-----

No blank lines before or after the dashes. No spaces on the BEGIN or END lines. If the file was generated by a tool like openssl, it should already be correct, but re-saving through a web browser or email client can silently corrupt the encoding.

Verifying the Fix

After correcting the file, confirm the certificate parses cleanly before restarting Apache:

openssl x509 -in /path/to/cert.pem -noout -text

If openssl prints the certificate details without complaint, Apache will load it without issue.

• Security

• Ssl
• SysAdmin