Troubleshoot common issues with CLB certificates - Server Load Balancer

If you encounter certificate-related issues with Classic Load Balancer (CLB), refer to this topic to troubleshoot them.

"Invalid parameter" error when you create a certificate
"The format of the parameter ServerCertificate is invalid. Modify the format and try again." error when you create a certificate
"No certificate chain is found in the certificate content" error when you create a certificate
"The format of the private key content is invalid" error after you enter a private key
"The format of the certificate content is invalid" error after you enter a public key
"The certificate does not exist" error after you select a server certificate when you configure an HTTPS listener
500 error when calling the UploadServerCertificate API operation (The request processing has failed due to some unknown error, exception or failure.)

"Invalid parameter" error during certificate creation

Symptom

On the Certificate Management page, when you Create Certificate, select Upload a third-party certificate, and click Create, the error Invalid parameter occurs.

Cause

Possible causes include:

The public key content is incorrect.
The system does not support the encoding format of your certificate.

Solution

If the public key content is incorrect, upload the certificate to a Linux server and run the following command to check the content:

openssl x509 -noout -text -in myprivate.pem

If the public key content is incorrect, the command returns an error message, such as bad base64 decode. Provide a public key with the correct content. The following is an example:
```
[root@iZxxx ~]# openssl x509 -noout -text -in  /root/zxxx.pem
unable to load certificate
139903831541648:error:0906D064:PEM_routines:PEM_read_bio:bad base64 decode:pem_lib.c:829:
```

Valid public key content produces output similar to the following:

[root@iZbxxxZ ~]# openssl x509 -noout -text -in  /root/zxxxw.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            09:0xxx7b:d7:ef
    Signature Algorithm: shaxxxryption
        Issuer: C=US, O=DigiCert Inc, OU=www.digxxxcom, CN=Encxxx xxxV TLS CA - G1
        Validity

If the encoding format is not supported, use a certificate in a supported encoding format. Alibaba Cloud supports certificates that are Base64-encoded in compliance with RFC 4648.

Invalid format of ServerCertificate parameter

Symptom

When you click Create Certificate on the Certificate Management page, select Upload Third-Party Certificate, and then click Create, the following error message appears: The format of the ServerCertificate parameter is incorrect. Please modify the format and try again.

Cause

The private key content is invalid.

Solution

Upload the certificate to a Linux server and run the following command to check its content:

openssl rsa -in myprivate.key -check

If the command returns an error, the private key is invalid.

[root@izlxxx Z ~]# openssl rsa -in /root/zlxxx.key -check
unable to load Private Key
140326021413632:error:0906D064:PEM routines:PEM_read_bio:bad base64 decode:pem_lib.c:829:

If the command output includes RSA key ok, the private key is valid.

[root@iZbpxxxxxxx4Z ~]# openssl rsa -in /root/zhxxxw.key -check
RSA key ok
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIxxxPJR4Jjq/Zw
AkGskM4xxxwN67MiEliC
Vjo25RixxxK3tretqQ69
OYxT2WUxvTR7NI6nCnMoKvk88aZHS/xxv9C0BoYU6v/OIkJ0bV5IeTRT9sOkUgH0
...
-----END RSA PRIVATE KEY-----

"Missing certificate chain" error

Symptom

When you Create Certificate on the Certificate Management page, select Upload Third-Party Certificate, and click Create, a Confirm dialog box is displayed with the error message: The certificate content is missing the certificate chain. A valid certificate chain must be formatted as follows: The first section begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- and contains the server's public key certificate (Base64-encoded). The second section has the same format and contains the intermediate CA certificate (Base64-encoded). No blank lines are allowed between the two certificate sections.

Cause

Certificate files from your certificate provider usually include your certificate and the intermediate CA certificate. These certificates form the certificate chain. When you upload a certificate, make sure you upload the complete certificate chain.

Solution

Contact your Certificate Authority (CA) to verify that the certificate chain is complete.

Invalid private key format error

Symptom

When you Create Certificate on the Certificate Management page, select Upload Third-Party Certificate, and enter the private key content, the error message The private key content is in an invalid format appears.

The error details indicate that the private key must start with -----BEGIN RSA PRIVATE KEY-----, end with -----END RSA PRIVATE KEY-----, and must be compatible with the NGINX format.

Cause

This issue occurs because the RSA private key format is invalid. A valid private key must start with -----BEGIN RSA PRIVATE KEY----- and end with -----END RSA PRIVATE KEY-----.

Solution

If the RSA private key is in the wrong format, upload it to a Linux server and run the following command to convert it:

openssl rsa -in old_server_key.pem -out new_server_key.pem

Later versions of OpenSSL may use the PKCS#8 format by default for openssl rsa command output, which can cause the conversion to fail. Use the openssl rsa -in old_server_key.pem -out new_server_key.pem -traditional command instead.

Invalid certificate content format error

Symptom

When you Create Certificate on the Certificate Management page and select Upload Third-Party Certificate, the error message The certificate content format is incorrect is reported after you enter the public key content. After you paste the certificate content on the SSL certificate public key upload page and click Upload, a red error message appears at the bottom of the page: The certificate content format is incorrect. The certificate content must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

Cause

The format of the public key content is invalid. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

Solution

Contact your Certificate Authority (CA) to verify the certificate content.

"Certificate does not exist" error

Symptom

When you configure an HTTPS listener and select an existing server certificate in the SSL certificate configuration wizard, you receive a The certificate does not exist error.

Cause

This error can occur if the CLB instance and the certificate are created with different account types. For example, the CLB instance is created by using an Alibaba Cloud account, but the certificate is created by using an Alibaba Finance Cloud account. In this case, the certificate is not recognized after it is uploaded.

Solution

Make sure that you use the same account to create the CLB instance and upload the certificate.

500 error when calling the UploadServerCertificate API operation (The request processing has failed due to some unknown error, exception or failure.)

This error is typically caused by an incorrect value for the AliCloudCertificateRegionId parameter. When you call this API operation, specify the region where the Alibaba Cloud SSL certificate is issued, not the region where the CLB instance resides. The certificate issuance region for Chinese mainland is cn-hangzhou, and the region for regions outside the Chinese mainland is ap-southeast-1.