nginx on Windows: cannot load certificate

After a certificate change, nginx on Windows no longer starts. The error log says cannot load certificate, usually followed by a path and an OpenSSL error. In the documented incident, backslashes in the configuration path were interpreted incorrectly; using forward slashes resolved that specific problem. Other occurrences of the same headline error still require their own diagnosis. Q1

Reach the file before diagnosing its contents

The nginx Windows documentation specifies forward slashes in configuration paths. Relative paths also depend on the startup prefix. Q2 A certificate visible in File Explorer can therefore still be searched for at the wrong location by the running process. Issuing a replacement certificate would not correct that mismatch.

A safe sequence of checks

1. Read the complete error. Keep the path and the remainder of the message together. Look for unexpected line breaks or characters disappearing after a backslash. Redact personal directory information only when sharing the evidence, without hiding the structural problem.
2. Identify the active configuration. Establish which nginx executable and configuration file the launch method uses. Several extracted nginx folders can cause an apparently correct edit to affect a different installation from the one being started.
3. Compare both file paths. Check ssl_certificate and ssl_certificate_key separately. A Windows configuration path can use the form C:/nginx/conf/certs/site.pem. Verify file extension, location and quoting. Do not print the private key into a diagnostic log.
4. Check access in the correct context. Identify the account starting the process and inspect its access to the intended files. Correct a specific missing permission rather than granting every user unrestricted access.
5. Test the intended configuration. Run the configuration check using the actual nginx installation. Once the file-loading problem is resolved, investigate any remaining key mismatch or chain problem as a separate finding. The HTTPS documentation explains the certificate and key relationship. Q3

Verify the resulting service

Preserve the previous configuration before making the bounded correction. Following a successful configuration test, perform the appropriate reload or start for this installation. Then request the intended hostname and inspect the certificate it serves. Removing one startup error does not establish that the correct virtual host or certificate was selected.

Useful handoff information includes the sanitised complete error, startup method, nginx version, relevant directives and configuration-test result. The private key itself is not needed for this initial assessment. Also note whether the problem began after moving files, changing the launch method or replacing the certificate.

Frequently asked questions

Does this mean my certificate expired?

The message first establishes a loading failure. File access and certificate expiry are separate checks.

Should I make the private key readable by everybody?

No. Identify the required process account and correct only the access it actually needs.

Describe your case