Connection failure after setting SSL on nginx

Posted on

Problem :

Im trying to set up https for a client on nginx and failing miserably

After uploading the certificate files and setting it up in the server config, I get a “Secure Connection Failed” (FF) when trying to access the server with https

I dont know much about nginx so I followed tutorials and the example on nginx.conf

The certificate files were not generated by me, my client sent then to me, so I cant be sure they are ok

My nginx conf

server {
    listen       80;
    server_name  almap-intranet.almapbbdo.com.br;

    charset utf-8;

    root   /var/www/html/wordpress;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?q=$uri&$args;
        #try_files $uri $uri/ =404;
    }
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    location ~ .php$ {
        try_files $uri =404;
        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /.ht {
        deny  all;
    }
}

server {
    listen      443 ssl http2 default_server;

    ssl         on;
    ssl_certificate     /etc/cert/almapbbdo.com.br.crt;
    ssl_certificate_key /etc/cert/almapbbdo.com.br.key;

    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers 'EECDH+AES128:EECDH+AES256:+SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RSA+3DES:!DSS';
    ssl_prefer_server_ciphers on;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;

    server_name  almap-intranet.almapbbdo.com.br;

    charset utf-8;

    root   /var/www/html/wordpress;
    index index.php index.html index.htm;

    location / {
        try_files $uri $uri/ /index.php?q=$uri&$args;
        #try_files $uri $uri/ =404;
    }
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    location ~ .php$ {
        try_files $uri =404;
        fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /.ht {
        deny  all;
    }
}

nginx -t says the configuration is ok

Running

telnet almap-intranet.almapbbdo.com.br 443 

it connects

Running

curl -vvvvvv https://almap-intranet.almapbbdo.com.br

It gives me:

* Rebuilt URL to: https://almap-intranet.almapbbdo.com.br/
* Hostname was NOT found in DNS cache
*   Trying 10.0.1.16...
* Connected to almap-intranet.almapbbdo.com.br (10.0.1.16) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS Unknown, Unknown (22):
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to almap-intranet.almapbbdo.com.br:443 
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to almap-intranet.almapbbdo.com.br:443 

Finally, tried

openssl s_client -debug -msg -connect almap-intranet.almapbbdo.com.br:443

It gives me this:

CONNECTED(00000003)
>>> ??? [length 0005]
    16 03 01 00 ab
>>> TLS 1.2Handshake [length 00ab], ClientHello
    01 00 00 a7 03 03 7f af 3f af d0 5e f0 22 69 ce
    19 29 e5 91 16 39 41 99 ac ed 2a 5c b0 8f 62 48
    3a 28 64 e9 6a a0 00 00 38 c0 2c c0 30 00 9f cc
    a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00
    6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 c0 09 c0
    13 00 33 00 9d 00 9c 00 3d 00 3c 00 35 00 2f 00
    ff 01 00 00 46 00 0b 00 04 03 00 01 02 00 0a 00
    0a 00 08 00 1d 00 17 00 19 00 18 00 23 00 00 00
    16 00 00 00 17 00 00 00 0d 00 20 00 1e 06 01 06
    02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03
    01 03 02 03 03 02 01 02 02 02 03
write to 0x247a710 [0x248aea0] (176 bytes => 176 (0xB0))
0000 - 16 03 01 00 ab 01 00 00-a7 03 03 7f af 3f af d0   .............?..
0010 - 5e f0 22 69 ce 19 29 e5-91 16 39 41 99 ac ed 2a   ^."i..)...9A...*
0020 - 5c b0 8f 62 48 3a 28 64-e9 6a a0 00 00 38 c0 2c   ..bH:(d.j...8.,
0030 - c0 30 00 9f cc a9 cc a8-cc aa c0 2b c0 2f 00 9e   .0.........+./..
0040 - c0 24 c0 28 00 6b c0 23-c0 27 00 67 c0 0a c0 14   .$.(.k.#.'.g....
0050 - 00 39 c0 09 c0 13 00 33-00 9d 00 9c 00 3d 00 3c   .9.....3.....=.<
0060 - 00 35 00 2f 00 ff 01 00-00 46 00 0b 00 04 03 00   .5./.....F......
0070 - 01 02 00 0a 00 0a 00 08-00 1d 00 17 00 19 00 18   ................
0080 - 00 23 00 00 00 16 00 00-00 17 00 00 00 0d 00 20   .#............. 
0090 - 00 1e 06 01 06 02 06 03-05 01 05 02 05 03 04 01   ................
00a0 - 04 02 04 03 03 01 03 02-03 03 02 01 02 02 02 03   ................
read from 0x247a710 [0x2481bd3] (5 bytes => -1 (0xFFFFFFFFFFFFFFFF))
write_errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1540328518
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Seems to be a handshake error but I have no idea why. Ive tried looking for the error and trying many random fixes Ive found, to no avail: always the same error

How can I better debug and narrow this? Is my configuration ok? Any help will be very welcome

Solution :

Not sure if this has anything to do with it, but i noticed in the curl command output i see

  CApath: /etc/ssl/certs

however in your nginx.conf file I see

   ssl_certificate     /etc/cert/almapbbdo.com.br.crt;
   ssl_certificate_key /etc/cert/almapbbdo.com.br.key;

do the certificates exist in both locations? if so, are they the same files?

Also noticed that from the internet when I try to scan almap-intranet.almapbbdo.com.br using the command nmap almap-intranet.almapbbdo.com.br

Starting Nmap 6.00 ( http://nmap.org ) at 2018-10-23 15:39 PDT
Nmap scan report for almap-intranet.almapbbdo.com.br (179.191.94.182)
Host is up (0.20s latency).
rDNS record for 179.191.94.182: mvx-179-191-94-182.mundivox.com
Not shown: 999 filtered ports
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 16.17 seconds

Could be a firewall thing, but I do not see any port 443 open.

Leave a Reply

Your email address will not be published. Required fields are marked *