# Internal Server Error After Updating SSL Certificates

**URL:** <https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895>\
**Category:** Get Help\
**Created:** [June 2, 2026, 6:54pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895 "2026-06-02T18:54:53Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 2, 2026, 6:54pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/1 "2026-06-02T18:54:53Z")

</div>

I just updated the certificates on our OnDemand server and now Dex is producing an “internal server error” message. Usually when we get the “internal server error” page, I just restart the ondemand-dex service and the error goes away. However, no matter what I do, the “internal server error” page will not go away. I’ve checked the permissions and ownership on the certificate and key files and they are correct. The only error I can find is in the httpd logs. The error is below:

[auth\_openidc:error] [pid 967753:tid 967917] [client] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://mydomain.edu/dex/.well-known/openid-configuration](https://mydomain.edu/dex/.well-known/openid-configuration) (error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt)  
[auth\_openidc:error] [pid 967753:tid 967917] [client] oidc\_provider\_static\_config: could not retrieve metadata from url: [https://mydomain.edu/dex/.well-known/openid-configuration](https://mydomain.edu/dex/.well-known/openid-configuration)

We are running OnDemand version 3.1.16 on RHEL 9.4. No configs have been changed. The only change that was made was replacing the old expired certificate and key file with a new certificate and key file. Any assistance would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 3, 2026, 1:19pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/2 "2026-06-03T13:19:13Z")

</div>

Does this file `/etc/pki/tls/certs/ca-bundle.crt` exist? Maybe @tdockendorf knows more.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 3, 2026, 1:40pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/3 "2026-06-03T13:40:11Z")

</div>

My only guess is the CA that signed your new certificate is not trusted by the system’s CA bundle. We run into this sometimes with LetsEncrypt when a new Intermediate or root CA is used. Also verify the ca-bundle exists at the path in the error per Jeff’s question.

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 3, 2026, 4:06pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/4 "2026-06-03T16:06:15Z")

</div>

The ca-bundle.crt file does exist. How would I update my systems ca-bundle.crt file?

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 3, 2026, 7:37pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/5 "2026-06-03T19:37:17Z")

</div>

I just checked the apache logs after reinstalling the ca-certificates package. The error has now changed. It is below:

[auth\_openidc:error] [pid 1323926:tid 1323962] [client] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://mydomain.edu/dex/.well-known/openid-configuration](https://mydomain.edu/dex/.well-known/openid-configuration) (SSL certificate problem: unable to get local issuer certificate)  
[auth\_openidc:error] [pid 1323926:tid 1323962] [client] oidc\_provider\_static\_config: could not retrieve metadata from url: [https://mydomain.edu/dex/.well-known/openid-configuration](https://mydomain.edu/dex/.well-known/openid-configuration)

Any assistance would be greatly appreciated as our production instance of OnDemand is down due to this. Thanks!

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 4, 2026, 8:42pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/6 "2026-06-04T20:42:14Z")

</div>

Looks like I didn’t reply properly. @jeff.ohrstrom and @tdockendorf, I have provided the information requested along with an update.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 4, 2026, 9:43pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/7 "2026-06-04T21:43:24Z")

</div>

[Unknown certificate authority when using openondemand-dex - #2 by tdockendorf](https://discourse.openondemand.org/t/unknown-certificate-authority-when-using-openondemand-dex/1083/2) may have some pointers on how to update the CA trust.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 4, 2026, 9:44pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/8 "2026-06-04T21:44:16Z")

</div>

If updating the CA trust doesn’t fix then please provide `/etc/ood/dex/config.yaml`

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 5, 2026, 4:36pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/9 "2026-06-05T16:36:01Z")

</div>

@tdockendorf,

I checked for updates for the ca-certificates package but none were available. Our /etc/ood/dex/config.yaml file is below:

```yaml

issuer: https://apps.talon.und.edu/dex
storage:
type: sqlite3
config:
file: “/etc/ood/dex/dex.db”
web:
http: localhost:5556
telemetry:
http: 0.0.0.0:5558
staticClients:

id: mydomain.edu
redirectURIs:

https://mydomain.edu/oidc
name: OnDemand
secret: <secret>
connectors:

type: ldap
id: ldap
name: LDAP
config:
host: ldap.mydomain.edu:636
insecureSkipVerify: false
bindDN: uid=ondemand,cn=users,cn=accounts,dc=mydomain,dc=edu
bindPW: <password>
userSearch:
baseDN: cn=users,cn=accounts,dc=mydomain,dc=edu
filter: “(objectClass=posixAccount)”
username: uid
idAttr: uid
emailAttr: mail
nameAttr: cn
preferredUsernameAttr: uid
groupSearch:
baseDN: cn=talon_users,cn=groups,cn=accounts,dc=mydomain,dc=edu
filter: “(objectClass=posixaccount)”
userMatchers:
- userAttr: DN
groupAttr: memberof
nameAttr: cn
oauth2:
skipApprovalScreen: true
enablePasswordDB: false
frontend:
dir: “/usr/share/ondemand-dex/web”
theme: talon
issuer: OnDemand
extra:
loginTitle: Log in with your credentials. If you do not have a CRC account,
you will need to submit a CRC account request at crc.mydomain.edu to access this
application.
loginButtonText: Log In
usernamePlaceholder: username (usually first.last)
passwordPlaceholder: password

```

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 5, 2026, 4:48pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/10 "2026-06-05T16:48:25Z")

</div>

Did you add the CA that signed the certificate to central trust store?

```auto
sudo cp <CA cert> /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract

```

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 5, 2026, 4:56pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/11 "2026-06-05T16:56:02Z")

</div>

Yes, that did not resolve the issue.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 5, 2026, 5:17pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/12 "2026-06-05T17:17:52Z")

</div>

> [@Dex Not Starting With SSL](https://discourse.openondemand.org/t/dex-not-starting-with-ssl/2719/6):
>
> Jeff, After adding the SSLCertificateChainFile to the ood\_portal.yml file, I’m now getting a login page. But after logging in, I get the attached error.

You may need to set `SSLCertificateChainFile`. Example:

```auto
$ sudo grep "ssl:" -A 3 /etc/ood/config/ood_portal.yml
ssl:
- SSLCertificateFile /etc/letsencrypt/live/ondemand.osc.edu/cert.pem
- SSLCertificateKeyFile /etc/letsencrypt/live/ondemand.osc.edu/privkey.pem
- SSLCertificateChainFile /etc/letsencrypt/live/ondemand.osc.edu/chain.pem

```

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 5, 2026, 5:29pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/13 "2026-06-05T17:29:13Z")

</div>

@tdockendorf,

SSLCertificateChain file was set previously. I took it out during troubleshooting. I have put it back and it’s set as follows:

‘SSLCertificateChainFile “/etc/pki/tls/certs/Intermediate\_ca\_root\_256\_R3.crt”’

Is the intermediate cert the correct cert to point at for the chain file?

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 5, 2026, 6:34pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/14 "2026-06-05T18:34:34Z")

</div>

If that file has intermediate cert(s) and root, then that’s what you want to use.

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 5, 2026, 7:04pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/15 "2026-06-05T19:04:02Z")

</div>

Ok, that’s what it’s set to but it’s still not working. I tried reinstalling the ondemand-dex package but that didn’t help either unfortunately.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [June 5, 2026, 7:29pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/16 "2026-06-05T19:29:42Z")

</div>

Are you sure that’s the correct intermediate and root CA?

```auto
openssl verify -CAfile /etc/pki/tls/certs/Intermediate_ca_root_256_R3.crt <file used for SSLCertificateFile>

```

Not certain this will work depending how the intermediate and CA are chained together. If you google ways to validate the certificate against the CA + intermediates, lots of ways to verify you have the correct files.

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 8, 2026, 9:12pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/17 "2026-06-08T21:12:47Z")

</div>

@tdockendorf,

I get “unable to get local issuer certificate” for both the intermediate and root certificate when I run the command you provided. I will search around to try and verify that I have the correct files.

---

<div class="post-metadata">

**Author:** ![brad.traver](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@brad.traver](https://discourse.openondemand.org/u/brad.traver)\
**Post date:** [June 9, 2026, 6:49pm UTC](https://discourse.openondemand.org/t/internal-server-error-after-updating-ssl-certificates/4895/18 "2026-06-09T18:49:17Z")

</div>

This issue has been resolved. As it turns out, we switched to a new certificate provider (Sectigo), and that provider is not trusted by Red Hat by default. Once we added their intermediate and root certificates to the CA trust and restarted the services, everything started working. Thanks @tdockendorf and @jeff.ohrstrom for your help on this!