# \[solved\] Sec\_error\_bad\_signature

**URL:** <https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983>\
**Category:** Help\
**Created:** [March 19, 2018, 12:40pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983 "2018-03-19T12:40:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![heiko](https://avatars.discourse-cdn.com/v4/letter/h/7ab992/32.png) [@heiko](https://community.letsencrypt.org/u/heiko)\
**Post date:** [March 19, 2018, 12:40pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/1 "2018-03-19T12:40:02Z")

</div>

I always get SEC\_ERROR\_BAD\_SIGNATURE in Browser (Firefox 59.0.1, Safari, Iridium, iCab), when I request or renew a Certificate.  
For every tested domain.

My example domain is:  
[www.intermezzo.net](http://www.intermezzo.net)

I ran this command:  
./letsencrypt request [www.intermezzo.net](http://www.intermezzo.net)  
(ACME1 and ACME2 tried)

```
Authorizing www.intermezzo.net.
 - Retrieving HTTP authentication challenge.
 - Retrieving authorization key.
Authorizing intermezzo.net.
 - Retrieving HTTP authentication challenge.
 - Retrieving authorization key.
Generating RSA key.
Generating CSR.
Retrieving certificate.
Using /usr/local/etc/hiawatha/tls/www.intermezzo.net.pem as output file.
Writing private key and certificate to file.
Retrieving CA certificate.
Writing CA certificate to file.

```

My web server is (include version):  
Hiawatha Webserver 10.8-rc1

The operating system my web server runs on is (include version):  
OpenBSD 6.2 (amd64)

My hosting provider, if applicable, is:  
[Hetzner.de](http://Hetzner.de)

I can login to a root shell on my machine (yes or no, or I don’t know):  
yes

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [March 19, 2018, 12:50pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/2 "2018-03-19T12:50:14Z")

</div>

Hi,

it seems that your server send two certs in one request.  
One is the correct certificate, however the other one is an selfsigned cert.

Can you check your config and make sure to remove the cert? (although i don’t know what happened since i can’t connect to your server)

Thank you

---

<div class="post-metadata">

**Author:** ![heiko](https://avatars.discourse-cdn.com/v4/letter/h/7ab992/32.png) [@heiko](https://community.letsencrypt.org/u/heiko)\
**Post date:** [March 19, 2018, 1:13pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/3 "2018-03-19T13:13:18Z")

</div>

I restarted the server. Sorry.

There is only one cert in the config. The issue is only with new certs. Old certs on other domains are still working.

The server banned you because of curl, I disabled this now 🙂

---

<div class="post-metadata">

**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\
**Post date:** [March 19, 2018, 2:05pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/4 "2018-03-19T14:05:00Z")

</div>

Checking with openssl tools, I get errors, too:

> $ openssl s\_client -connect [www.intermezzo.net:443](http://www.intermezzo.net:443) -servername [www.intermezzo.net](http://www.intermezzo.net)  
> CONNECTED(00000003)  
> depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3  
> 140296662271648:error:0407006A:rsa routines:RSA\_padding\_check\_PKCS1\_type\_1:block type is not 01:rsa\_pk1.c:100:  
> 140296662271648:error:04067072:rsa routines:RSA\_EAY\_PUBLIC\_DECRYPT:padding check failed:rsa\_eay.c:721:  
> 140296662271648:error:1408D07B:SSL routines:SSL3\_GET\_KEY\_EXCHANGE:bad signature:s3\_clnt.c:1840:

I would check if the components of the certificate file are valid.

---

<div class="post-metadata">

**Author:** ![hiawatha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/hiawatha/32/8720_2.png) [@hiawatha](https://community.letsencrypt.org/u/hiawatha)\
**Post date:** [March 19, 2018, 6:23pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/5 "2018-03-19T18:23:01Z")

</div>

This is due to a bug in Hiawatha’s Let’s Encrypt script. This topic can be closed.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [April 18, 2018, 6:23pm UTC](https://community.letsencrypt.org/t/solved-sec-error-bad-signature/56983/6 "2018-04-18T18:23:34Z")

</div>

Closed on April 18, 2018, 6:23pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.