SECURITY WARNING: Never run commands you don't understand. Always review code before execution. Use at your own risk.
FixMyError.net
WebServer New Added 26 October 2026

nginx: [emerg] cannot load certificate "/etc/ssl/my.crt": BIO_new_file() failed

nginx could not open the certificate file at all, before reading a byte of it, so this is about the file and not the certificate. The end of the message tells you which. No such file or directory usually means a Let's Encrypt path for a certificate that was never issued, or a symlink in live/ whose target in archive/ has gone. Permission denied means the file cannot be read, often because of SELinux, or because nginx -t was run without sudo and only root can read the keys.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix
# Test as root, the way the service starts
sudo nginx -t

# Does the path exist, and does every symlink resolve?
sudo namei -l /etc/letsencrypt/live/example.com/fullchain.pem
sudo readlink -f /etc/letsencrypt/live/example.com/fullchain.pem

# Which certificates does certbot hold, and under which names?
sudo certbot certificates

# Never issued? Comment out the ssl server block, reload, then issue it
sudo certbot --nginx -d example.com

# SELinux denying a certificate stored somewhere unusual
sudo ausearch -m avc -ts recent | grep nginx
sudo semanage fcontext -a -t cert_t "/srv/certs(/.*)?"
sudo restorecon -Rv /srv/certs

How to diagnose WebServer errors

Web server errors are usually about permissions, binding, or configuration that was never loaded. A common trap: the server runs as an unprivileged user (www-data, nginx), so it needs execute permission on every directory in the path to a file, not just read permission on the file itself. Another: editing a config file changes nothing until the server is reloaded and the file is actually included.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

  1. Validate configuration before reloading: nginx -t, apachectl configtest, caddy validate. This catches syntax errors without dropping traffic.
  2. Dump the fully resolved configuration with nginx -T to see what is actually in effect, including every include.
  3. Read the error log, not the access log, for 5xx causes. nginx names the failing upstream and the exact filesystem path it could not open.
  4. For permission errors, test as the server user: sudo -u www-data cat /path/to/file. Check execute bits on every parent directory.
  5. For binding failures, find the current listener with ss -tulpn | grep :80. Ports below 1024 need privileges or a capability such as CAP_NET_BIND_SERVICE.

Tools worth reaching for

  • nginx -t / nginx -T
  • apachectl configtest
  • ss -tulpn
  • tail -f error.log
  • sudo -u www-data

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

nginx.org eff-certbot.readthedocs.io

Related WebServer errors

See all 20 WebServer errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.