I can’t access my sites over https. Exact error message is browser specific, for example “A connection was reset (corresponding to a TCP RST).” When I try nothing is recorded in the nginx logs for the sites I’m trying to access, so I’m not sure if the request is getting as far as nginx.
Checking the server is listening on 443, running sudo netstat -plutn
shows
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 31216/nginx: master
Checking if the firewall is blocking 443, running iptables -L -n -v
, the only lines mentioning 443 or 80 are:
29235 1687K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
253 13652 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
And checking from another machine if port 443 is open, running nc -zv mysite.com 443
shows Connection to mysite.com port [tcp/https] succeeded!
Probably the most basic server block I have in my nginx config file is:
server {
listen 443 ssl http2;
server_name static2.mysite.com;
#Allow access for lets encrypt challenge
location /.well-known {
allow all;
}
ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;
include ssl.conf;
#rewrite to static1.
return 301 https://static1.mysite.com$request_uri;
}
(though this particular one doesn’t have logging, other server blocks that also don’t work, do have logging).
and ssl.conf looks like:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:$
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
And I definitely restarted nginx.
So I’m not sure what the problem is, unless it’s the actual cert files generated by lets encrypt are invalid, but I don’t know how I’d check that?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Click below to sign up and get $100 of credit to try our products over 60 days!
@djeyewater
Even Nginx 1.11.0 should work with OpenSSL 1.1, but there has been some bug-fixes in newer versions of Nginx, so I would recommend Nginx 1.12 or higher if you want to use OpenSSL 1.1
Unless you’re compiling Nginx yourself, then there’s not a large repository, which is compiled against OpenSSL 1.1, but the Ondrej works even though it’s compiled against 1.0.2: https://launchpad.net/~ondrej/+archive/ubuntu/nginx
I have never seen the error you’ve encountered, so I’m interested in what your end-solution to this problem is.
Hi @djeyewater
I’m not sure if it’s just a console cut-off, but can you change your
ssl_ciphers
to this:Then restart Nginx and since you have chosen not to display your domain, can you run the SSL Labs test: https://www.ssllabs.com/ssltest/
You can use this generator to make other cipher suites: https://mozilla.github.io/server-side-tls/ssl-config-generator/
And since you’re using Ubuntu, I would recommend these commands for quicker overview: