Did you try cat private.key my.crt > /etc/pmg/pmg-api.pem (obviously exchange the two filenames with your own) and restart? In case of a self signed one, the certificate must be present in the browsers, otherwise you'll have to accept the self-signed one again.