1

I have configured SSL on my LEMP with a self-signed certificate according to the instructions here: https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04

The ONLY exception is the default_server which I will not be able to use because this will be a multi-vhost server (eventually)

Nothing fails during the entire process until I attempt to browse the site via HTTPS, it fails with Secure Connection Failed with no other option to bypass. (I expect an error based on the self-signed cert, but in Firefox there is usually that 'Advanced' button I can bypass with.)

I have also verified that the proper ports are open to the server via netstat -ntlp

netstat output

You can browse the site here if you wish to see the error message: https://www.azem.us/ (it's non-production, so I'm not real worried about it...)

Running curl -I https://www.azem.us/ is returning me the following error: curl: (35) gnutls_handshake() failed: The TLS connection was non-properly terminated.

What's really got me, is there is nothing in any configured error log.

What can I do to fix this, and be able to serve up these sites with SSL?

NOTE: This also happens with a properly SSL certificate from a real CA

Progress Diagnosing Running openssl s_client -connect www.azem.us:443 is returning me some interesting info:

CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1474399712
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

I am probably off in my thinking but doesnt this mean the certificates do not exist on the server? I can verify that they do indeed exist, and are properly configured in my nginx.conf

And with: openssl s_client -verify www.azem.us:443 Returns:

verify depth is 0
connect: Connection refused
connect:errno=111

Per nmap from another machine

Host is up (0.0043s latency).
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

telnet can connect, but immediately closes the connection when attempting port 443

GIT REPO to config: https://github.com/kpirnie/LEMP-Command

Finally getting somewhere... I changed the error_log level for the main nginx.conf and am now getting an error in the log: 2016/09/21 08:22:58 [error] 29557#29557: *4 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: this.is.my.ip, server: 0.0.0.0:443

  • 2
    Please don't post screenshots of text, as it is not easy to read; instead, copy the text here and apply code formatting. Also, it looks like you have enabled HSTS and OCSP stapling. With HSTS, modern browsers will outright refuse to connect to a site unless it can connect properly via HTTPS, because HSTS is the site telling the browser to do so. – muru Sep 20 '16 at 18:49
  • 1
    With curl I get back "curl: (35) Encountered end of file" w/o the insecure option. I would look again at your nginx options. Have you run nginx -t? – Jeroen Sep 20 '16 at 19:11
  • 1
    HSTS doesn't go away by just disabling it, browsers remember that setting. Try with a different browser. – muru Sep 20 '16 at 19:14
  • 1
    my guess is that the problem is with nginx configuration. Perhaps there is no file served or so? Please add e.g. the sites-available config to ur q. And please check the site of Bjorn Johansen and linked configs. The best tutorial I have found on ssl and nginx – Jeroen Sep 20 '16 at 22:07
  • 1
    Given this happens with legitimate and self signed certs it is almost definitely a problem with the configs or possibly the keys or the cert not being read right, check /var/log/nginx/error.log for any related TLS errors and please include your configs if possible. (If you see TLS errors in the error.log file, please include the error messages you are seeing as well) – Thomas Ward Sep 21 '16 at 0:24
2

After much discussion, and deliberation here, I found what the issue was.

In my main nginx.conf I was setting the listen directives to both port 80 and 443

Once I removed them, and added them to the VHost configurations, it started working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.