Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or SSLEngine on is set without any certificate.
SSLCertificateFile: file does not exist or is emptyAH02240: Server should be SSL-aware but has no certificate configuredAH02572: Failed to configure at least one certificate and key forServer should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]AH00526: Syntax error SSLCertificateFile Meaning
Check the paths in the vhost (SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile/ full chain), ensure the files exist and are readable by root (Apache reads them at start before dropping privileges), and that mod_ssl is enabled.
Common causes
- Wrong path or file renamed by renewal
- SSLEngine on without certificate directives
- File empty (failed copy)
- mod_ssl not enabled
- SELinux context blocking
⚡ Quick fix
apachectl configtestand fix reported paths- Enable
a2enmod ssland the SSL site - Restore the file or reissue the certificate
Detailed fix by platform
Linux
apachectl configtest && ls -l /etc/letsencrypt/live/example.com/
How to diagnose
- Path — File exists?
- Directives — Certificate and key set?
- Module — mod_ssl on?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- AH00558 Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name
- AH01909: server certificate does NOT include an ID which matches the server name Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
- CAA record forbids issuance Let's Encrypt/CA: CAA record for example.com prevents issuance
Most viewed in SSL / TLS
- NET::ERR_CERT_COMMON_NAME_INVALID NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)
- Challenge failed for domain Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404
- no start line OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
Other ways to find it
Where this error sits
Origin: Network. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 4 Nov 2026