Note:<\/strong> The product is now called Control Web Panel<\/strong> and lives at control-webpanel.com<\/a>. The service name ( Before you replace the self signed SSL certificate, make sure you have:<\/p>\n\n\n\n The diagram below shows why a missing self signed SSL certificate takes the panel offline:<\/p>\n\n\n\n For general OpenSSL options, see the OpenSSL documentation<\/a>.<\/p>\n\n\n\n You’re looking for an error like this:<\/p>\n\n\n\n Correction to the original diagnosis:<\/strong> The original guide said the problem was an expired<\/em> self signed SSL certificate. An expired certificate only causes a browser warning, not this error. “No such file or directory” means the file is missing<\/strong>, or it’s a symlink pointing at a file that no longer exists. Step 2 tells you which.<\/p>\n<\/blockquote>\n\n\n\n If either file is missing, or shows as a symlink to a target that doesn’t exist, you need to create a new pair.<\/p>\n\n\n\n If either file is present, copy it aside before overwriting:<\/p>\n\n\n\n It’s fine if Notes:<\/strong><\/p>\n\n\n\n The private key should be readable by root only.<\/p>\n\n\n\n The last command confirms something is listening on port 2031. Then open the panel:<\/p>\n\n\n\n Your browser will show a security warning, which is expected for a self signed SSL certificate. Accept it to continue. To confirm the new certificate’s dates:<\/p>\n\n\n\n When the panel is unreachable but the service and firewall look fine, read the Why is the panel unreachable when cwpsrv shows as running?<\/strong> The service can start but fail to open its SSL certificate, which logs an error and leaves the HTTPS listener unusable. Always read the logs, not just the service status.<\/p>\n\n\n\n Will the new self signed SSL certificate expire again?<\/strong> Yes, after the number of days you set with Does the browser trust a self signed SSL certificate?<\/strong> No. You’ll see a warning on every new browser until you install a trusted certificate for the panel’s hostname. The connection is still encrypted.<\/p>\n\n\n\n Do other services use these same files?<\/strong> Possibly. If your mail or FTP services are configured to use the same certificate paths, restart them as well so they pick up the new files.<\/p>\n\n\n\n SSL\/TLS Configuration and Verification on Linux<\/a><\/p>\n\n\n\ncwpsrv<\/code>) and the admin port (2031) are unchanged. CentOS 7 is past end-of-life, but these steps work the same on AlmaLinux and Rocky Linux.<\/p>\n<\/blockquote>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
Architecture<\/h2>\n\n\n\n
\n
cwpsrv<\/code> is the panel’s own web server. It listens on port 2031 and reads a self signed SSL certificate and private key from \/etc\/pki\/tls\/<\/code> when it starts<\/li>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/CWP-SSL-Certificate-Loading-Error-1024x683.png\")
<\/a><\/figure>\n\n\n\nSteps to Generate a New Self Signed SSL Certificate for CWP<\/h2>\n\n\n\n
1. Confirm the Cause in the Logs<\/h3>\n\n\n\n
sudo journalctl -u cwpsrv --no-pager | tail -n 20\n<\/pre>\n\n\n\n
cwpsrv: [emerg] IO_new_file(\"\/etc\/pki\/tls\/certs\/hostname.crt\") failed (SSL: error:02001002:system library:fopen:No such file or directory ...)\n<\/pre>\n\n\n\n
\n
2. Check the Certificate Files<\/h3>\n\n\n\n
ls -l \/etc\/pki\/tls\/certs\/hostname.crt \/etc\/pki\/tls\/private\/hostname.key\n<\/pre>\n\n\n\n
3. Back Up Anything That Exists<\/h3>\n\n\n\n
sudo mkdir -p \/root\/cwp-ssl-backup\nsudo cp -a \/etc\/pki\/tls\/certs\/hostname.crt \/etc\/pki\/tls\/private\/hostname.key \/root\/cwp-ssl-backup\/ 2>\/dev\/null\n<\/pre>\n\n\n\n
cp<\/code> reports that a file doesn’t exist.<\/p>\n\n\n\n4. Generate the New Certificate and Key<\/h3>\n\n\n\n
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \\\n -keyout \/etc\/pki\/tls\/private\/hostname.key \\\n -out \/etc\/pki\/tls\/certs\/hostname.crt \\\n -subj \"\/CN=$(hostname -f)\"\n<\/pre>\n\n\n\n
\n
\n
-subj<\/code> fills in the certificate’s name automatically, so the command doesn’t stop to ask interactive questions. Make sure hostname -f<\/code> prints your server’s real hostname.<\/li>\n\n\n\n-days 365<\/code> will expire in a year. That’s harmless for the panel to start, but browsers will keep warning. Raise the number for fewer renewals, or install a trusted certificate to remove the warning entirely.<\/li>\n\n\n\n5. Set the Correct Permissions<\/h3>\n\n\n\n
sudo chmod 600 \/etc\/pki\/tls\/private\/hostname.key\nsudo chmod 644 \/etc\/pki\/tls\/certs\/hostname.crt\n<\/pre>\n\n\n\n
6. Restart CWP and Verify<\/h3>\n\n\n\n
sudo systemctl restart cwpsrv.service\nsudo systemctl status cwpsrv.service\nsudo ss -tlnp | grep 2031\n<\/pre>\n\n\n\n
https:\/\/your-server-ip:2031\n<\/pre>\n\n\n\n
openssl x509 -in \/etc\/pki\/tls\/certs\/hostname.crt -noout -dates\n<\/pre>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2019\/03\/Screen-Shot-2019-03-18-at-1.45.01-PM-1024x484-1.png\")
<\/a><\/figure>\n\n\n\nConclusion<\/h2>\n\n\n\n
cwpsrv<\/code> logs. If they show a missing hostname.crt<\/code>, generating a fresh self signed SSL certificate and key, setting the right permissions, and restarting cwpsrv<\/code> brings the panel back. The cause is a missing or broken file rather than an expired certificate, which is why checking the files in Step 2 matters.<\/p>\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
-days<\/code>. Expiry itself won’t stop the panel from starting, but browsers will warn. Use a longer period, or install a certificate from a trusted authority.<\/p>\n\n\n\nRelated Articles<\/h2>\n\n\n\n