# Apache AH02572: failed to configure certificate and key

> Apache stops with AH02572 when mod_ssl cannot load a matching certificate and key. The log line above it names the cause: key mismatch, format or path.

Source: https://ssl.sh/errors/apache-ah02572-failed-to-configure-certificate/
Last updated: 2026-11-10

**AH02572 means mod_ssl could not configure a single working certificate and [private key](https://ssl.sh/glossary/private-key/) pair for the virtual host, so Apache stops.** The message itself is only a summary; the line logged right before it names the actual problem, most often a key that does not belong to the certificate.

## Quick fix

Different public key hashes for the certificate and the key confirm the most common cause.

Read the preceding lines and test the files directly:

```bash
sudo apachectl configtest
sudo grep -B5 AH02572 /var/log/apache2/error.log      # RHEL: /var/log/httpd/ssl_error_log
sudo openssl x509 -in /etc/ssl/example.com/fullchain.pem -noout -pubkey | openssl sha256
sudo openssl pkey -in /etc/ssl/example.com/privkey.pem -pubout | openssl sha256
```

If the hashes differ, the key and certificate are not a pair. If they match, check the other causes below. Restart with `sudo systemctl restart apache2` (or `httpd`) once `configtest` reports `Syntax OK`.

## Causes

A certificate and key that do not belong together cause most AH02572 failures. Nginx reports the same problem as [key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/).

### 1. Certificate and key do not match

Apache typically logs `AH02565: Certificate and private key ... do not match` before AH02572.

- **Confirm:** the two hashes above differ, or the [key matcher](https://ssl.sh/tools/key-matcher/) shows different public keys.
- **Fix:** use the key generated with the CSR for this certificate. If it is lost, create a new key and CSR and have the certificate reissued. Also make sure the first certificate in SSLCertificateFile is your leaf, not an intermediate.

### 2. The key is encrypted

An encrypted key (`BEGIN ENCRYPTED PRIVATE KEY`) needs a passphrase. Under systemd nobody can type it, so loading fails.

- **Confirm:** the log mentions an encrypted private key, or `head -1 privkey.pem` shows `ENCRYPTED`.
- **Fix:** configure `SSLPassPhraseDialog exec:/usr/local/sbin/ssl-pass.sh`, or decrypt the key once with `openssl pkey -in enc.key -out privkey.pem` and `chmod 600` it.

### 3. Wrong file format or wrong file

DER files, PKCS#12 bundles (`.pfx`), or a CA bundle referenced as SSLCertificateFile all fail to load.

- **Confirm:** `openssl x509 -in <file> -noout -subject` fails or shows a CA name instead of your domain.
- **Fix:** convert to PEM (`openssl pkcs12 -in site.pfx -nokeys -out fullchain.pem` and `-nocerts -nodes -out privkey.pem`). The [SSL converter](https://ssl.sh/tools/ssl-converter/) explains the formats.

### 4. Files missing or unreadable

- **Confirm:** the log shows `No such file or directory` or `Permission denied`; on RHEL-family systems `ls -Z` shows a wrong SELinux label.
- **Fix:** correct the paths, keep keys owned by root with mode 600, and run `sudo restorecon -Rv /etc/pki/tls` (or your certificate directory).

### 5. Key type not supported

Old OpenSSL builds or FIPS-mode systems may reject some key types or sizes.

- **Fix:** use RSA 2048+ or ECDSA P-256/P-384.

## Fixes by environment

Every platform needs the same result: a PEM certificate and its matching key that Apache can read at start-up.

**Debian / Ubuntu**

```apache
<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>
```

Enable the module and site with `a2enmod ssl` and `a2ensite`, then `systemctl reload apache2`.

**RHEL / Rocky / AlmaLinux:** the package `mod_ssl` ships `/etc/httpd/conf.d/ssl.conf` with a default `_default_:443` virtual host that references `localhost.crt`. If those files are missing, that default host itself triggers AH02572; fix its paths or remove the block.

**Windows (Apache Lounge builds):** use forward slashes in paths. `SSLPassPhraseDialog builtin` is not supported on Windows, so the key must be unencrypted or use an `exec:` helper.

**Certbot:** the Apache plugin writes a separate `-le-ssl.conf` file. If you also keep an old 443 virtual host for the same name, remove the duplicate.

**Multiple certificates (RSA + ECDSA):** each `SSLCertificateFile` must be followed by its matching `SSLCertificateKeyFile` in the same order.

## Don't do this

- **Comment out `SSLEngine on` to get Apache to start.** Port 443 then serves plain HTTP and every HTTPS visitor gets a protocol error.
- **Make the key world-readable** to work around permission errors. Apache reads keys as root at start-up.
- **Keep restarting with the broken config.** A failed restart stops every site on the server; always run `apachectl configtest` first.