Like .cer, a .crt file is also a certificate, not a private key. If you don’t already have the key, you must generate a new key-pair: bash openssl genrsa -out private.key 2048 Then reissue the certificate using the new key.