Below you can see my apache2 virtual host SSL config from one of our domains, which works fine:


    # Example SSL configuration
    SSLEngine on
    #SSLProtocol all -SSLv2
    #SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    SSLCertificateFile "/etc/ssl/certs/company/cert"
    SSLCertificateKeyFile "/etc/ssl/certs/company/key"
    SSLCertificateChainFile "/etc/ssl/certs/company/ca-bundle"


I need to upgrade another website to make it use SSL.

But our IT department only gave me the cert and the ca-bundle, they say that the private key is included in the ca-bundle

So I tried to ommit "SSLCertificateKeyFile" but it still does not work this way.

So is the private key really included in the CA bundle?

I've read that it can be included in the certificate itself, but it is highly discouraged.

"Finally the end-entity certificate's private key can also be added to the certificate file instead of using a separate SSLCertificateKeyFile directive. This practice is highly discouraged. If it is used, the certificate files using such an embedded key must be configured after the certificates using a separate key file. If the private key is encrypted, the pass phrase dialog is forced at startup time."


  • 1
    Search in bundle file for -----BEGIN RSA PRIVATE KEY----- Sep 20, 2022 at 10:16
  • There is only 3x -----BEGIN CERTIFICATE-----
    – Black
    Sep 20, 2022 at 11:17
  • 1
    So there is no private key in this file. Sep 20, 2022 at 11:30
  • 1
    Sounds logical. Thank you!
    – Black
    Sep 20, 2022 at 12:07

1 Answer 1


One possible way (if the bundle is in PAM format) is to search for string:


also searching only for


can be enough

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .