Outline

• I have generated a set of SSL certificates with certbot certonly for a domain (replaced with example here)
• I have an express server set up to use those certificates, there don't seem to be any issues reading the files, since they look right when I console.log them
• The certificate files, at least to my eye, look correctly formatted (with the correct headers & start lines)
• I am aware that similar questions exist, but in all of those that I could find, the issue is that the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines were missing from the certificate & private key files, that doesn't seem to be the case here.

Problem

The https module is giving me the error error:0480006C:PEM routines::no start line when I try to start the server with https.

The Code

app.js

const express = require('express');
const http = require('http');
const https = require('https');
const fs = require('fs');
const { config } = require('dotenv');

config();

const app = express();

const httpPort = process.env.HTTP_PORT;
const httpsPort = process.env.HTTPS_PORT;

try {
  const privateKeyPath = process.env.SSL_KEY;
  const publicKeyPath = process.env.SSL_CERT;
  const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
  const certificate = fs.readFileSync(publicKeyPath, 'utf8');
  const credentials = { key: privateKey, cert: certificate };
  const httpsServer = https.createServer(credentials, app);
  httpsServer.listen(httpsPort, () => {
    console.log(`HTTPS Server listening on port ${httpsPort}`);
  });
} catch (ex) {
  console.error('Certificates not found. Not using HTTPS');
  console.error(ex);
}

const httpServer = http.createServer(app);

httpServer.listen(httpPort, () => {
  console.log(`HTTP Server listening on port ${httpPort}`);
});

.env

HTTP_PORT=80
HTTPS_PORT=443
SSL_KEY=/etc/letsencrypt/live/example/fullchain.pem
SSL_CERT=/etc/letsencrypt/live/example/privkey.pem

fullchain.pem

-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----

privkey.pem

-----BEGIN PRIVATE KEY-----
 ...base64 encoded text here
-----END PRIVATE KEY-----

Output

Certificates not found. Not using HTTPS
Error: error:0480006C:PEM routines::no start line
    at node:internal/tls/secure-context:69:13
    at Array.forEach (<anonymous>)
    at setCerts (node:internal/tls/secure-context:67:3)
    at configSecureContext (node:internal/tls/secure-context:156:5)
    at Object.createSecureContext (node:_tls_mon:117:3)
    at Server.setSecureContext (node:_tls_wrap:1348:27)
    at Server (node:_tls_wrap:1207:8)
    at new Server (node:https:74:3)
    at Object.createServer (node:https:112:10)
    at Object.<anonymous> (/root/reponame/app.js:78:29) {
  library: 'PEM routines',
  reason: 'no start line',
  code: 'ERR_OSSL_PEM_NO_START_LINE'
}

Outline

• I have generated a set of SSL certificates with certbot certonly for a domain (replaced with example. here)
• I have an express server set up to use those certificates, there don't seem to be any issues reading the files, since they look right when I console.log them
• The certificate files, at least to my eye, look correctly formatted (with the correct headers & start lines)
• I am aware that similar questions exist, but in all of those that I could find, the issue is that the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines were missing from the certificate & private key files, that doesn't seem to be the case here.

Problem

The https module is giving me the error error:0480006C:PEM routines::no start line when I try to start the server with https.

The Code

app.js

const express = require('express');
const http = require('http');
const https = require('https');
const fs = require('fs');
const { config } = require('dotenv');

config();

const app = express();

const httpPort = process.env.HTTP_PORT;
const httpsPort = process.env.HTTPS_PORT;

try {
  const privateKeyPath = process.env.SSL_KEY;
  const publicKeyPath = process.env.SSL_CERT;
  const privateKey = fs.readFileSync(privateKeyPath, 'utf8');
  const certificate = fs.readFileSync(publicKeyPath, 'utf8');
  const credentials = { key: privateKey, cert: certificate };
  const httpsServer = https.createServer(credentials, app);
  httpsServer.listen(httpsPort, () => {
    console.log(`HTTPS Server listening on port ${httpsPort}`);
  });
} catch (ex) {
  console.error('Certificates not found. Not using HTTPS');
  console.error(ex);
}

const httpServer = http.createServer(app);

httpServer.listen(httpPort, () => {
  console.log(`HTTP Server listening on port ${httpPort}`);
});

.env

HTTP_PORT=80
HTTPS_PORT=443
SSL_KEY=/etc/letsencrypt/live/example./fullchain.pem
SSL_CERT=/etc/letsencrypt/live/example./privkey.pem

fullchain.pem

-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
 ...base64 encoded text here
-----END CERTIFICATE-----

privkey.pem

-----BEGIN PRIVATE KEY-----
 ...base64 encoded text here
-----END PRIVATE KEY-----

Output

Certificates not found. Not using HTTPS
Error: error:0480006C:PEM routines::no start line
    at node:internal/tls/secure-context:69:13
    at Array.forEach (<anonymous>)
    at setCerts (node:internal/tls/secure-context:67:3)
    at configSecureContext (node:internal/tls/secure-context:156:5)
    at Object.createSecureContext (node:_tls_mon:117:3)
    at Server.setSecureContext (node:_tls_wrap:1348:27)
    at Server (node:_tls_wrap:1207:8)
    at new Server (node:https:74:3)
    at Object.createServer (node:https:112:10)
    at Object.<anonymous> (/root/reponame/app.js:78:29) {
  library: 'PEM routines',
  reason: 'no start line',
  code: 'ERR_OSSL_PEM_NO_START_LINE'
}

• javascript
• node.js
• ssl
• https
• certbot

• 1 fs.readFileSync doesn't output a error if it fails to read a file, have you tried printing the keys in node to see if they are not empty ? – Dumitru Birsan Commented Jan 18, 2023 at 8:24
• Yes, I've run console.log on both files, and they both seem to be being read. – Ashley Commented Jan 18, 2023 at 8:35
• 6 make sure you haven't mixed cert and privkey, did a few tests and saw that if you give wrong certificate to 'key' parameter you get this error – Dumitru Birsan Commented Jan 18, 2023 at 8:55
• @DivineSoul that was exactly the issue. Thank you so much. – Ashley Commented Jan 18, 2023 at 11:10
• @DivineSoul if you're able to add that as an answer I can accept it as valid. – Ashley Commented Jan 18, 2023 at 11:14

1 Answer 1

As stated by @DivineSoul, the issue was that I had the private key path & public key path switched around the wrong way.