jwb
By:
jwb

SSL connection error - ubuntu / apache

October 22, 2014 16.9k views

Hey,

Apologies first of all, because I basically have no idea what I'm doing, so please be patient with me!

I've just started up a new droplet which has Ubuntu / Apache and Wordpress on and I got a free .me domain and PositiveSSL cert from namecheap (using the Github student pack) ...but unfortunately I'm having issues with the SSL setup.

I followed the comodo guide for obtaining a .csr + .key (goo.gl/rKkUHc), opened/copy/pasted the csr into namecheap's application box, and went though the process of obtaining the certificate files from comodo. I enabled the a2enmod ssl thing, and finally followed Comodo's guide to install the certificate and .key (goo.gl/WaklqY) before restarting apache.

...Unfortunately, no matter what I seem to do, I can't seem to find anything that fixes my issue, or I just fail to understand what people are talking about when searching through google.

The only changes that I basically made were adding the certificate/key files to /etc/ssl/ssl.key and ssl.crt folders that I created, and also editing the /etc/apache2/sites-enabled/default-ssl.conf to change the file names / locations.

So, I'm kinda stumped, I don't know if there's something I've missed, or whatever, but any help would be much appreciated, Thanks!


p.s. The error I get when trying to connect to https://mysite.me OR https://www.mysite.me (as the certificate covers both) using chrome, is:

Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
Error code: ERR_SSL_PROTOCOL_ERROR
6 comments
  • Hi! Do you see any errors in Apache's error log?

    sudo tail /var/log/apache2/error.log
    
  • Hmm, that's just apache responding to service apache2 restart or service apache2 stop. Try reading the last 40 or so lines:

    sudo tail -40 /var/log/apache2/error.log
    

    Are there any SSL-related errors? If not, can you post your virtualhost config?

  • Nothing different in there, so sure!

    This is from /etc/apache2/sites-available/default-ssl.conf (which I think is the correct file for this?):

    Note: I only changed the "SSLCertificateFile", "SSLCertificateKeyFile" and "SSLCertificateChainFile" entries, as instructed in the tutorials I followed, I didn't want to touch anything else, because I don't really understand what they are.

    <IfModule mod_ssl.c>
            <VirtualHost _default_:443>
                    ServerAdmin webmaster@localhost
    
                    DocumentRoot /var/www/html
    
                    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                    # error, crit, alert, emerg.
                    # It is also possible to configure the loglevel for particular
                    # modules, e.g.
                    #LogLevel info ssl:warn
    
                    ErrorLog ${APACHE_LOG_DIR}/error.log
                    CustomLog ${APACHE_LOG_DIR}/access.log combined
    
                    # For most configuration files from conf-available/, which are
                    # enabled or disabled at a global level, it is possible to
                    # include a line for only one particular virtual host. For example the
                    # following line enables the CGI configuration for this host only
                    # after it has been globally disabled with "a2disconf".
                    #Include conf-available/serve-cgi-bin.conf
    
                    #   SSL Engine Switch:
                    #   Enable/Disable SSL for this virtual host.
                    SSLEngine on
    
                    #   A self-signed (snakeoil) certificate can be created by installing
                    #   the ssl-cert package. See
                    #   /usr/share/doc/apache2/README.Debian.gz for more info.
                    #   If both key and certificate are stored in the same file, only the
                    #   SSLCertificateFile directive is needed.
                    SSLCertificateFile      /etc/ssl/ssl.crt/mysite_me.crt
                    SSLCertificateKeyFile /etc/ssl/ssl.key/mysite_me.key
    
                    #   Server Certificate Chain:
                    #   Point SSLCertificateChainFile at a file containing the
                    #   concatenation of PEM encoded CA certificates which form the
                    #   certificate chain for the server certificate. Alternatively
                    #   the referenced file can be the same as SSLCertificateFile
                    #   when the CA certificates are directly appended to the server
                    #   certificate for convinience.
                    SSLCertificateChainFile /etc/ssl/ssl.crt/mysite_me.ca-bundle
    
                    #   Certificate Authority (CA):
                    #   Set the CA certificate verification path where to find CA
                    #   certificates for client authentication or alternatively one
                    #   huge file containing all of them (file must be PEM encoded)
                    #   Note: Inside SSLCACertificatePath you need hash symlinks
                    #                to point to the certificate files. Use the provided
                    #                Makefile to update the hash symlinks after changes.
                    #SSLCACertificatePath /etc/ssl/certs/
                    #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
    
                    #   Certificate Revocation Lists (CRL):
                    #   Set the CA revocation path where to find CA CRLs for client
                    #   authentication or alternatively one huge file containing all
                    #   of them (file must be PEM encoded)
                    #   Note: Inside SSLCARevocationPath you need hash symlinks
                    #                to point to the certificate files. Use the provided
                    #                Makefile to update the hash symlinks after changes.
                    #SSLCARevocationPath /etc/apache2/ssl.crl/
                    #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
    
                    #   Client Authentication (Type):
                    #   Client certificate verification type and depth.  Types are
                    #   none, optional, require and optional_no_ca.  Depth is a
                    #   number which specifies how deeply to verify the certificate
                    #   issuer chain before deciding the certificate is not valid.
                    #SSLVerifyClient require
                    #SSLVerifyDepth  10
    
                    #   SSL Engine Options:
                    #   Set various options for the SSL engine.
                    #   o FakeBasicAuth:
                    #        Translate the client X.509 into a Basic Authorisation.  This means that
                   #        the standard Auth/DBMAuth methods can be used for access control.  The
                    #        user name is the `one line' version of the client's X.509 certificate.
                    #        Note that no password is obtained from the user. Every entry in the user
                    #        file needs this password: `xxj31ZMTZzkVA'.
                    #   o ExportCertData:
                    #        This exports two additional environment variables: SSL_CLIENT_CERT and
                    #        SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
                    #        server (always existing) and the client (only existing when client
                    #        authentication is used). This can be used to import the certificates
                    #        into CGI scripts.
                    #   o StdEnvVars:
                    #        This exports the standard SSL/TLS related `SSL_*' environment variables.
                    #        Per default this exportation is switched off for performance reasons,
                    #        because the extraction step is an expensive operation and is usually
                    #        useless for serving static content. So one usually enables the
                    #        exportation for CGI and SSI requests only.
                    #   o OptRenegotiate:
                    #        This enables optimized SSL connection renegotiation handling when SSL
                    #        directives are used in per-directory context.
                    #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
                    <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                    SSLOptions +StdEnvVars
                    </FilesMatch>
                    <Directory /usr/lib/cgi-bin>
                                    SSLOptions +StdEnvVars
                    </Directory>
    
                    #   SSL Protocol Adjustments:
                    #   The safe and default but still SSL/TLS standard compliant shutdown
                    #   approach is that mod_ssl sends the close notify alert but doesn't wait for
                    #   the close notify alert from client. When you need a different shutdown
                    #   approach you can use one of the following variables:
                    #   o ssl-unclean-shutdown:
                    #        This forces an unclean shutdown when the connection is closed, i.e. no
                    #        SSL close notify alert is send or allowed to received.  This violates
                    #        the SSL/TLS standard but is needed for some brain-dead browsers. Use
                    #        this when you receive I/O errors because of the standard approach where
                    #        mod_ssl sends the close notify alert.
                    #   o ssl-accurate-shutdown:
                    #        This forces an accurate shutdown when the connection is closed, i.e. a
                    #        SSL close notify alert is send and mod_ssl waits for the close notify
                    #        alert of the client. This is 100% SSL/TLS standard compliant, but in
                    #        practice often causes hanging connections with brain-dead browsers. Use
                    #        this only for browsers where you know that their SSL implementation
                    #        works correctly.
                    #   Notice: Most problems of broken clients are also related to the HTTP
                    #   keep-alive facility, so you usually additionally want to disable
                    #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
                    #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
                    #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
                    #   "force-response-1.0" for this.
                    BrowserMatch "MSIE [2-6]" \
                                    nokeepalive ssl-unclean-shutdown \
                                    downgrade-1.0 force-response-1.0
                    # MSIE 7 and newer should be able to use keepalive
                    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
    
            </VirtualHost>
    </IfModule>
    
    # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
    
  • ah just spotted the # before chain file... should probably try fixing that...

    edit: doesn't seem to have fixed anything.

  • I am running into a similar problem like this one with the SSL. Was this solved? If so, how? There're no errors in the logs with SSL and I did some tests from looking around and 443 is on. ports.conf has reference to it. port 80 is working since I can connect via the web..

    The browsers are saying

    Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
    Error code: ERRSSLPROTOCOL_ERROR

    or something related, depends on the browser.

    The server certificates are installe from RapidSSL, but tests from their end show the SSL is not working

  • Sorry, I didn't really need the SSL cert and ended up just giving up because I got it for free anyway. Hope you find an answer though.

2 Answers

Hi.
I had the same problem - wanted to secure the phpmyadmin page.
Turned out that the default-ssl.conf was not enabled by default (the apache2 default configuration for https pages).

To fix this run: a2ensite default-ssl.conf
Don't forget to: service apache2 reload

Have another answer? Share your knowledge.