Question
Can't get https working with nginx & let's encrypt
I can’t access my sites over https. Exact error message is browser specific, for example “A connection was reset (corresponding to a TCP RST).”
When I try nothing is recorded in the nginx logs for the sites I’m trying to access, so I’m not sure if the request is getting as far as nginx.
Checking the server is listening on 443, running sudo netstat -plutn
shows
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 31216/nginx: master
Checking if the firewall is blocking 443, running iptables -L -n -v
, the only lines mentioning 443 or 80 are:
29235 1687K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
253 13652 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
And checking from another machine if port 443 is open, running nc -zv mysite.com 443
shows Connection to mysite.com port [tcp/https] succeeded!
Probably the most basic server block I have in my nginx config file is:
server {
listen 443 ssl http2;
server_name static2.mysite.com;
#Allow access for lets encrypt challenge
location /.well-known {
allow all;
}
ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;
include ssl.conf;
#rewrite to static1.
return 301 https://static1.mysite.com$request_uri;
}
(though this particular one doesn’t have logging, other server blocks that also don’t work, do have logging).
and ssl.conf looks like:
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:$
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
And I definitely restarted nginx.
So I’m not sure what the problem is, unless it’s the actual cert files generated by lets encrypt are invalid, but I don’t know how I’d check that?
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
×