Apache AH02572: failed to configure certificate and key

AH02572 means mod_ssl could not configure a single working certificate and private key pair for the virtual host, so Apache stops. The message itself is only a summary; the line logged right before it names the actual problem, most often a key that does not belong to the certificate.

Quick fix

Different public key hashes for the certificate and the key confirm the most common cause.

Read the preceding lines and test the files directly:

sudo apachectl configtest
sudo grep -B5 AH02572 /var/log/apache2/error.log      # RHEL: /var/log/httpd/ssl_error_log
sudo openssl x509 -in /etc/ssl/example.com/fullchain.pem -noout -pubkey | openssl sha256
sudo openssl pkey -in /etc/ssl/example.com/privkey.pem -pubout | openssl sha256

If the hashes differ, the key and certificate are not a pair. If they match, check the other causes below. Restart with sudo systemctl restart apache2 (or httpd) once configtest reports Syntax OK.

Causes

A certificate and key that do not belong together cause most AH02572 failures. Nginx reports the same problem as key values mismatch.

1. Certificate and key do not match

Apache typically logs AH02565: Certificate and private key ... do not match before AH02572.

• Confirm: the two hashes above differ, or the key matcher shows different public keys.
• Fix: use the key generated with the CSR for this certificate. If it is lost, create a new key and CSR and have the certificate reissued. Also make sure the first certificate in SSLCertificateFile is your leaf, not an intermediate.

2. The key is encrypted

An encrypted key (BEGIN ENCRYPTED PRIVATE KEY) needs a passphrase. Under systemd nobody can type it, so loading fails.

• Confirm: the log mentions an encrypted private key, or head -1 privkey.pem shows ENCRYPTED.
• Fix: configure SSLPassPhraseDialog exec:/usr/local/sbin/ssl-pass.sh, or decrypt the key once with openssl pkey -in enc.key -out privkey.pem and chmod 600 it.

3. Wrong file format or wrong file

DER files, PKCS#12 bundles (.pfx), or a CA bundle referenced as SSLCertificateFile all fail to load.

• Confirm: openssl x509 -in <file> -noout -subject fails or shows a CA name instead of your domain.
• Fix: convert to PEM (openssl pkcs12 -in site.pfx -nokeys -out fullchain.pem and -nocerts -nodes -out privkey.pem). The SSL converter explains the formats.

4. Files missing or unreadable

• Confirm: the log shows No such file or directory or Permission denied; on RHEL-family systems ls -Z shows a wrong SELinux label.
• Fix: correct the paths, keep keys owned by root with mode 600, and run sudo restorecon -Rv /etc/pki/tls (or your certificate directory).

5. Key type not supported

Old OpenSSL builds or FIPS-mode systems may reject some key types or sizes.

• Fix: use RSA 2048+ or ECDSA P-256/P-384.

Fixes by environment

Every platform needs the same result: a PEM certificate and its matching key that Apache can read at start-up.

Debian / Ubuntu

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>

Enable the module and site with a2enmod ssl and a2ensite, then systemctl reload apache2.

RHEL / Rocky / AlmaLinux: the package mod_ssl ships /etc/httpd/conf.d/ssl.conf with a default _default_:443 virtual host that references localhost.crt. If those files are missing, that default host itself triggers AH02572; fix its paths or remove the block.

Windows (Apache Lounge builds): use forward slashes in paths. SSLPassPhraseDialog builtin is not supported on Windows, so the key must be unencrypted or use an exec: helper.

Certbot: the Apache plugin writes a separate -le-ssl.conf file. If you also keep an old 443 virtual host for the same name, remove the duplicate.

Multiple certificates (RSA + ECDSA): each SSLCertificateFile must be followed by its matching SSLCertificateKeyFile in the same order.

Don't do this

• Comment out SSLEngine on to get Apache to start. Port 443 then serves plain HTTP and every HTTPS visitor gets a protocol error.
• Make the key world-readable to work around permission errors. Apache reads keys as root at start-up.
• Keep restarting with the broken config. A failed restart stops every site on the server; always run apachectl configtest first.