3

I'm trying to get nginx to do load balancing across my web servers, while terminating SSL at the load balancer level. The nginx.conf file I'm using is based on all the guides for doing this exact thing yet I can't get it to work. When going to standard HTTP, the load balancer works fine. However, when trying to access the load balancer via HTTPS the browser just hangs, eventually giving ERR_CONNECTION_REFUSED.

I see no errors in the logs, or even anything in the access logs when attempting HTTPS so I have no idea what the problem could be. I've tried lots of different configuration options, including trying different SSL certs, PEM encoding, bundling certs and so on all to no effect.

Here is the main part of the nginx.conf:

upstream backend {
    #web01
    server 10.01.01.102;
    #web02
    server 10.02.02.77;
}

#setup proxy
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# standard http server
server {
    listen 80;
    listen 4444;

    server_name *.example.com;

    location / {
        proxy_pass http://backend;
    }
}

#server for https requests
server {
    listen 443 ssl;

    server_name *.example.com;

    #ssl on;
    ssl_certificate /path/to/example.com.crt;
    ssl_certificate_key /path/to/example.com.key;

    location / {
        proxy_pass http://backend;
    }
}

Does anyone have any ideas? With no error output I'm not sure how to figure out what the issue is.

EDIT:

Still nothing in the logs when attempting to connect to HTTPS. The logs are setup and working when accessing the HTTP server (I get entries in the access log). Here is the relevant part of the nginx.conf file for the logs:

access_log /var/log/nginx/nginx.vhost.access.log;
error_log /var/log/nginx/nginx.vhost.error.log;

I just tested that the error log is working correctly and it is. I did so by removing the 'ssl_certificate' entry from the server block in the config file and then attempted to connect again. The error log (/var/log/nginx/nginx.vhost.error.log;) showed:

2014/09/23 13:41:28 [error] 10047#0: *9 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:443.

I have put the ssl_certificate entry back, but I wanted to confirm the error logs are working. I also took a look through all the logs in /var/log and didn't see any errors related to nginx.

8
  • 1
    How about telnet localhost 443 from load balancer? What's the output of netstat -tulpn | grep 443 on load balancer?
    – masegaloeh
    Sep 23, 2014 at 2:27
  • The output of the netstat is: tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 20638/nginx
    – peacemaker
    Sep 23, 2014 at 13:02
  • Also, telnet to localhost 443 gives me what looks like an nginx error page html with the title: <h1>400 Bad Request</h1>. It's a start I guess, thanks for the suggestion. Any other ideas you can think of from that @masegaloeh ?
    – peacemaker
    Sep 23, 2014 at 13:05
  • Hi, you wrote you checked the accesslogs, can you check the errorlogs, and syslog or messages maybe you'll find out more in there. So far nginx always reported an error to me (if there was an error)
    – Jeredepp
    Sep 23, 2014 at 13:17
  • 1
    Firewall maybe? Those firewall may permit you to telnet via localhost but not from outside....
    – masegaloeh
    Sep 23, 2014 at 15:13

1 Answer 1

5

In the comments, you have verified that nginx process was running and telnet localhost 443 was working. But it doesn't mean that the outside party can reach your nginx. One layer you should check was firewall. It will inspect and drop the packet flowing to nginx if you don't allow rule to port 443.

Sidenote: Nginx error 400 Bad request, usually means that you telnet to nginx in https port but your request wasn't clear text or incomplete (e.g. no HTTP headers defined)

1
  • Thanks for this! I realized I had checked the firewall on AWS but not the software firewall, opening port 443 fixed this issue.
    – peacemaker
    Sep 24, 2014 at 13:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .