title: SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch but modulus match
body: <p>I have nginx server with StartSSL free certificate which will expire soon. I wanted to renew it.</p>
  
  <pre><code>openssl req -new -sha256 -nodes -days 365 -newkey rsa:2048 -keyout ssl.key -out ssl.csr
  </code></pre>
  
  <p>where I enter informations needed for certificate generation. I pasted this CSR into website and successfully got signed certificate for domain and 2 subdomain on main domain.</p>
  
  <p>After I load the certificate server output this error:</p>
  
  <pre><code>feb 05 17:46:19 systemd[1]: Unit nginx.service entered failed state.
  feb 05 17:47:13 nginx[4514]: nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/ssl/nginx.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
  feb 05 17:47:13 nginx[4514]: nginx: configuration file /etc/nginx/nginx.conf test failed
  feb 05 17:47:13 systemd[1]: nginx.service: control process exited, code=exited status=1
  feb 05 17:47:13 systemd[1]: Failed to start A high performance web server and a reverse proxy server.
  </code></pre>
  
  <p>I tested modulus with these commands:</p>
  
  <pre><code>openssl x509 -noout -modulus -in nginx.crt | openssl md5
  openssl rsa -noout -modulus -in nginx.key | openssl md5
  openssl req -noout -modulus -in ssl.csr | openssl md5
  </code></pre>
  
  <p>and they match.</p>
  
  <p>StartSSL provide certificate bundle with intermediate certificate in it. I found that it  can fail if they are not in correct order, so I tryed both of them as first certificate without success.</p>
  
  <p>EDIT: I tried to key and certificate on another server with nginx 1.9.3 and it is working. So certificate is OK but server is not.</p>