Question

Can't get https working with nginx & let's encrypt

I can’t access my sites over https. Exact error message is browser specific, for example “A connection was reset (corresponding to a TCP RST).” When I try nothing is recorded in the nginx logs for the sites I’m trying to access, so I’m not sure if the request is getting as far as nginx.

Checking the server is listening on 443, running sudo netstat -plutn shows

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      31216/nginx: master

Checking if the firewall is blocking 443, running iptables -L -n -v, the only lines mentioning 443 or 80 are:

29235 1687K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
  253 13652 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

And checking from another machine if port 443 is open, running nc -zv mysite.com 443 shows Connection to mysite.com port [tcp/https] succeeded!

Probably the most basic server block I have in my nginx config file is:

server {
        listen          443 ssl http2;
        server_name     static2.mysite.com;

        #Allow access for lets encrypt challenge
        location /.well-known {
                allow all;
        }

        ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;
        include ssl.conf;


#rewrite to static1.
return 301 https://static1.mysite.com$request_uri;

}

(though this particular one doesn’t have logging, other server blocks that also don’t work, do have logging).

and ssl.conf looks like:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:$
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;

And I definitely restarted nginx.

So I’m not sure what the problem is, unless it’s the actual cert files generated by lets encrypt are invalid, but I don’t know how I’d check that?

Subscribe
Share

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

@djeyewater

Even Nginx 1.11.0 should work with OpenSSL 1.1, but there has been some bug-fixes in newer versions of Nginx, so I would recommend Nginx 1.12 or higher if you want to use OpenSSL 1.1

Unless you’re compiling Nginx yourself, then there’s not a large repository, which is compiled against OpenSSL 1.1, but the Ondrej works even though it’s compiled against 1.0.2: https://launchpad.net/~ondrej/+archive/ubuntu/nginx

I have never seen the error you’ve encountered, so I’m interested in what your end-solution to this problem is.

Hi @djeyewater

I’m not sure if it’s just a console cut-off, but can you change your ssl_ciphers to this:

ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';

Then restart Nginx and since you have chosen not to display your domain, can you run the SSL Labs test: https://www.ssllabs.com/ssltest/

You can use this generator to make other cipher suites: https://mozilla.github.io/server-side-tls/ssl-config-generator/

And since you’re using Ubuntu, I would recommend these commands for quicker overview:

sudo lsof -iTCP -sTCP:LISTEN -P
sudo ufw status