Nginx SSL Configuration Failing

Question

I have configured SSL on my LEMP with a self-signed certificate according to the instructions here: https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04

The ONLY exception is the default_server which I will not be able to use because this will be a multi-vhost server (eventually)

Nothing fails during the entire process until I attempt to browse the site via HTTPS, it fails with Secure Connection Failed with no other option to bypass. (I expect an error based on the self-signed cert, but in Firefox there is usually that 'Advanced' button I can bypass with.)

I have also verified that the proper ports are open to the server via netstat -ntlp

You can browse the site here if you wish to see the error message: https://www.azem.us/ (it's non-production, so I'm not real worried about it...)

Running curl -I https://www.azem.us/ is returning me the following error: curl: (35) gnutls_handshake() failed: The TLS connection was non-properly terminated.

What's really got me, is there is nothing in any configured error log.

What can I do to fix this, and be able to serve up these sites with SSL?

NOTE: This also happens with a properly SSL certificate from a real CA

Progress Diagnosing Running openssl s_client -connect www.azem.us:443 is returning me some interesting info:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1474399712
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

I am probably off in my thinking but doesnt this mean the certificates do not exist on the server? I can verify that they do indeed exist, and are properly configured in my nginx.conf

And with: openssl s_client -verify www.azem.us:443 Returns:

verify depth is 0
connect: Connection refused
connect:errno=111

Per nmap from another machine

Host is up (0.0043s latency).
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

telnet can connect, but immediately closes the connection when attempting port 443

GIT REPO to config: https://github.com/kpirnie/LEMP-Command

Finally getting somewhere... I changed the error_log level for the main nginx.conf and am now getting an error in the log: 2016/09/21 08:22:58 [error] 29557#29557: *4 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: this.is.my.ip, server: 0.0.0.0:443

Answer 1

After much discussion, and deliberation here, I found what the issue was.

In my main nginx.conf I was setting the listen directives to both port 80 and 443

Once I removed them, and added them to the VHost configurations, it started working.