I have configured SSL on my LEMP with a self-signed certificate according to the instructions here: https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04
The ONLY exception is the
default_server which I will not be able to use because this will be a multi-vhost server (eventually)
Nothing fails during the entire process until I attempt to browse the site via HTTPS, it fails with
Secure Connection Failed with no other option to bypass. (I expect an error based on the self-signed cert, but in Firefox there is usually that 'Advanced' button I can bypass with.)
I have also verified that the proper ports are open to the server via
You can browse the site here if you wish to see the error message: https://www.azem.us/ (it's non-production, so I'm not real worried about it...)
curl -I https://www.azem.us/ is returning me the following error:
curl: (35) gnutls_handshake() failed: The TLS connection was non-properly terminated.
What's really got me, is there is nothing in any configured error log.
What can I do to fix this, and be able to serve up these sites with SSL?
NOTE: This also happens with a properly SSL certificate from a real CA
openssl s_client -connect www.azem.us:443 is returning me some interesting info:
CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 305 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1474399712 Timeout : 300 (sec) Verify return code: 0 (ok) ---
I am probably off in my thinking but doesnt this mean the certificates do not exist on the server? I can verify that they do indeed exist, and are properly configured in my
openssl s_client -verify www.azem.us:443
verify depth is 0 connect: Connection refused connect:errno=111
Per nmap from another machine
Host is up (0.0043s latency). Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 443/tcp open https
telnet can connect, but immediately closes the connection when attempting port 443
GIT REPO to config: https://github.com/kpirnie/LEMP-Command
Finally getting somewhere... I changed the
error_log level for the main nginx.conf and am now getting an error in the log:
2016/09/21 08:22:58 [error] 29557#29557: *4 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: this.is.my.ip, server: 0.0.0.0:443