How to deal with "RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)" problem

If you see [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) in you apache error.log file means you have created a cert that is intended to be used to sign other certs, but you're using that cert as your SSL cert. So, it depends how you create the SSL cert.

But how can we solve this problem?!

1. Generate private key and certificate signing request

[codesyntax lang="bash"]

openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
openssl rsa -passin pass:x -in server.pass.key -out server.key
rm server.pass.key
openssl req -new -key server.key -out server.csr


Note: when the openssl req command asks for a “challenge password”, just press return, leaving the password empty.

2. Generate SSL certificate

[codesyntax lang="bash"]

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt


  1. Edgar Conrado

    Thanks for your help, it was very helpful

  2. Thanks for your help, I have finally resolve my problem.

  3. Stephen Hawkins

    Didnt work

  4. Tim Williams

    This made no difference, I still have the same error.

  5. Hi, I hope you can help me
    I've have 3 certificate files: > it's coded with Let's Encrypt1#0!ULet's Encrypt Authority X30 > ----BEGIN RSA PRIVATE KEY----- > also coded

    Which files do I have to use to solve the (BasicConstraints: CA == TRUE !?)” problem?
    server.pass.key = ?
    server.key = ?

  6. Hi, last question
    When I fixed the CA==TRUE problem. Which files do I add to Apache 2.2 sni.conf
    SSLCertificateFile ""
    SSLCertificateKeyFile ""
    SSLCertificateChainFile ""
    SSLCACertificateFile ""

    THX for you....

    • In case anyone else comes across this, i solved my issue with these settings in apache virtualhost ssl config file -

      SSLCertificateFile "C:/path-to-file/server.crt"
      SSLCertificateKeyFile "C:/path-to-file/server.key"
      SSLCertificateChainFile "C:/path-to-file/server.csr"

  7. Thanks you very much JONAS, I solve this warn

  8. Thanks a lot! Very helpful stuff.
    We had two warns on the error log:
    [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
    [warn] RSA server certificate CommonName (CN) `l0035' does NOT match server name!?

    Solved all after the first one taken care of. So thank you.

  9. work only in chrome , no in FF or IE

  10. The second command didn't work for me but I noticed that the openssl genrsa command required a pass of 4 characters or more. I edited the commands to use pass:xxxx where appropriate. Worked great.

  11. Thanks. Really helpful!

  12. Thank you!
    Should you also remove the signing request file?

Scrie si tu o vorbulita

NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.