SSLCertificateFile: file does not exist SSL / TLS Origin: Network Last updated 4 Nov 2026

Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty

Apache cannot find the certificate or key file named in its configuration, or SSLEngine on is set without any certificate.

Exact message you may see SSLCertificateFile: file does not exist or is emptyAH02240: Server should be SSL-aware but has no certificate configuredAH02572: Failed to configure at least one certificate and key forServer should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]AH00526: Syntax error SSLCertificateFile
Seen on: SSL Linux

Meaning

Check the paths in the vhost (SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile/ full chain), ensure the files exist and are readable by root (Apache reads them at start before dropping privileges), and that mod_ssl is enabled.

Common causes

  • Wrong path or file renamed by renewal
  • SSLEngine on without certificate directives
  • File empty (failed copy)
  • mod_ssl not enabled
  • SELinux context blocking

⚡ Quick fix

  1. apachectl configtest and fix reported paths
  2. Enable a2enmod ssl and the SSL site
  3. Restore the file or reissue the certificate

Detailed fix by platform

Linux

  1. apachectl configtest && ls -l /etc/letsencrypt/live/example.com/

How to diagnose

  1. Path — File exists?
  2. Directives — Certificate and key set?
  3. Module — mod_ssl on?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids is…certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate does not …Certificate pinning failure! — Android/OkHttp: javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure! Peer certificate chain: sha256/... Pinned certificates for api.example.com (SSL / TLS)Certificate pinning f…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin CA …Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not establish t…DEPTH_ZERO_SELF_SIGNED_CERT — Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT) (SSL / TLS)DEPTH_ZERO_SELF_SIGNE…SSLCertif…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.