Okta Access Gateway Reports a "PEM_do_header:bad password read" Error When Uploading a Certificate
Last Updated:
Overview
Okta Access Gateway (OAG) does not support password-protected certificates, which causes a bad password read error during upload. Remove the password from the certificate using OpenSSL commands to resolve the error. When uploading a password-protected certificate, Okta Access Gateway generates the following error message:
PEM_do_header:bad password read error
Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
- Okta Access Gateway (OAG)
- SSL Certificate
Cause
The Okta Access Gateway appliance does not support password-protected certificates. Okta Access Gateway displays the following error message in the Management interface during the certificate upload:
failed to create symbolic link '/opt/oag/nginx/ssl/mycertificate_com.key': File exists
Enter PEM pass phrase:
nginx: [emerg] SSL_CTX_use_PrivateKey_file("/opt/oag/nginx/ssl/%_mycertificate_com.key") failed (SSL: error:0906406D:PEM routines:PEM_def_callback:problems getting password error:0906A068:PEM routines:PEM_do_header:bad password read error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
nginx: configuration file /opt/oag/nginx/conf/nginx.conf test failed
Error: There was a problem using this certificate! Rolling back previous certificate
Solution
How is the certificate password removed?
Remove the certificate password using the appropriate OpenSSL command based on whether the certificate and key are separate or combined.
- For a standalone certificate key, execute the following command:
openssl rsa -in key.pem -out newkey.pem - For a combined certificate and key, execute the following command:
openssl rsa -in mycert.pem -out newcert.pem openssl x509 -in mycert.pem >>newcert.pem
