unable to load Private Key SSL / TLS Origin: Network Last updated 4 Nov 2026

OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pasted where the key belongs.

Exact message you may see unable to load Private Keyerror:0909006C:PEM routines:get_name:no start linePEM_read_bio:no start lineExpecting: ANY PRIVATE KEYproblems getting password
Explore the map of this error Full error map →
Seen on: SSL Linux

Meaning

Check the file really begins with -----BEGIN PRIVATE KEY----- / BEGIN RSA PRIVATE KEY. Encrypted keys need a passphrase or must be decrypted (openssl rsa -in enc.key -out plain.key). DER or PKCS#12 files must be converted to PEM. Also confirm permissions allow the server to read it.

Common causes

  • Certificate file given in place of the key
  • Key encrypted with a passphrase (server can't prompt)
  • DER/PFX format instead of PEM
  • Wrong path or permissions
  • Windows line endings or truncated copy-paste

⚡ Quick fix

  1. Inspect: head -1 server.key
  2. Decrypt: openssl rsa -in enc.key -out server.key
  3. Convert PFX: openssl pkcs12 -in x.pfx -nocerts -nodes -out server.key

Detailed fix by platform

Linux

  1. openssl rsa -in server.key -check -noout validates an RSA key

How to diagnose

  1. Header — BEGIN PRIVATE KEY?
  2. Encrypted — Passphrase?
  3. Format — PEM?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee k…certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate does not …Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore was tampered…no start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start linePKCS12: Mac verify error: invalid password? — OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password? (SSL / TLS)PKCS12: Mac verify er…SSL routines: wrong version number — OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (SSL / TLS)SSL routines: wrong v…SSL_CTX_use_PrivateKey_file failed (key values mismatch) — Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) (SSL / TLS)SSL_CTX_use_PrivateKe…SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile: f…unable to…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.