# OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

**Code:** `unable to load Private Key` · **Category:** SSL / TLS · **Seen on:** SSL, Linux

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pasted where the key belongs.

## Meaning

Check the file really begins with `-----BEGIN PRIVATE KEY-----` / `BEGIN RSA PRIVATE KEY`. Encrypted keys need a passphrase or must be decrypted (`openssl rsa -in enc.key -out plain.key`). DER or PKCS#12 files must be converted to PEM. Also confirm permissions allow the server to read it.

## Common causes

- Certificate file given in place of the key
- Key encrypted with a passphrase (server can't prompt)
- DER/PFX format instead of PEM
- Wrong path or permissions
- Windows line endings or truncated copy-paste

## Quick fix

1. Inspect: `head -1 server.key`
2. Decrypt: `openssl rsa -in enc.key -out server.key`
3. Convert PFX: `openssl pkcs12 -in x.pfx -nocerts -nodes -out server.key`

## Detailed fix by platform

### Linux

1. `openssl rsa -in server.key -check -noout` validates an RSA key

## How to diagnose

1. **Header** — BEGIN PRIVATE KEY?
2. **Encrypted** — Passphrase?
3. **Format** — PEM?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/unable-to-load-private-key)