Getting SSL to work with neo4j can be very frustrating. The crux of the problem is that their documentation isn’t very robust.
Here’s what they don’t tell you:
Both the cert and the key MUST be in DER format!
example to convert a PEM formatted crt key to a der formatted crt key
openssl x509 -in server.crt -outform der -out server.crt.deropenssl rsa -in server.key -outform der -out server.key.der