Apache不能启动：SSL Library Error: -8181 Certificate has expired

某日服务器重启后，Apache无法启动，查看Apache错误日志：

cat /var/log/httpd/error_log

发现有如下报错：

[Wed Aug 25 18:49:00.134257 2021] [:error] [pid 1607] SSL Library Error: -8181 Certificate has expired
[Wed Aug 25 18:49:00.134318 2021] [:error] [pid 1607] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

用如下命令查看证书信息，发现证书已经到期了：

certutil -d /etc/httpd/alias -L -n Server-Cert
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4 (0x4)
        Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
        Issuer: "CN=Certificate Shack,O=example.com,C=US"
        Validity:
            Not Before: Fri Jan 24 15:03:11 2017
            Not After : Wed Jan 24 15:03:11 2021

可以用临时方法解决：
先设置禁止检查证书，待更新证书后再取消此设置，操作方法：
在/etc/httpd/conf.d/nss.conf文件中加入NSSEnforceValidCerts off设置来暂时取消检查证书。

永久的解决办法就是重新生成证书，命令如下：

yum install httpd mod_nss
certutil -d /etc/httpd/alias -L -n Server-Cert
cd /etc/httpd/alias
rm -f *.db
/usr/sbin/gencert /etc/httpd/alias > /etc/httpd/alias/install.log 2>&1

然后查看证书到期日期已经正常。

certutil -d /etc/httpd/alias -L -n Server-Cert
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4 (0x4)
        Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
        Issuer: "CN=Certificate Shack,O=example.com,C=US"
        Validity:
            Not Before: Fri Aug 27 07:27:30 2021
            Not After : Wed Aug 27 07:27:30 2025

尝试启动Apache，发现仍然不能启动。再次查看错误日志，发现有了新的报错：

[Fri Aug 27 15:38:17.483837 2021] [:error] [pid 15043] Server user apache lacks read access to NSS key database /etc/httpd/alias/key3.db.

应该是apache用户对key3.db这个文件没有权限。
我们查看一下文件属性：

ls -l /etc/httpd/alias/
total 88
-rw-------. 1 root root 65536 Oct 26 17:26 cert8.db
-rw-------. 1 root root    5872 Oct 26 17:26 install.log
-rw-------. 1 root root 16384 Oct 26 17:26 key3.db
lrwxrwxrwx. 1 root root      24 Nov 15 10:58 libnssckbi.so -> /usr/lib64/libnssckbi.so
-rw-------. 1 root root 16384 Oct 26 17:26 secmod.db

接着修改/etc/httpd/alias/目录下所有db文件的属性：

chown :apache /etc/httpd/alias/*.db 
chmod u=rw,g=r  *.db

用下面两条命令效果一样：

chown root.apache /etc/httpd/alias/*.db
chmod 0640 /etc/httpd/alias/*.db

修改完之后再查看一下db文件的属性：

ls -l /etc/httpd/alias/
total 88
-rw-r-----. 1 root apache 65536 Oct 26 17:26 cert8.db
-rw-------. 1 root root    5872 Oct 26 17:26 install.log
-rw-r-----. 1 root apache 16384 Oct 26 17:26 key3.db
lrwxrwxrwx. 1 root root      24 Nov 15 10:58 libnssckbi.so -> /usr/lib64/libnssckbi.so
-rw-r-----. 1 root apache 16384 Oct 26 17:26 secmod.db

最后启动apache：

systemctl start httpd

启动成功！