Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following setup:

  • An Apache server running on CentOS 5.5. Locally, it connects OK using SSL.

  • A proxy between my server and the external network. I doesn't control this proxy. It forwards a port to the https port on my server.

  • A CNAME records that maps my the external DNS name I want for my server to the proxy.

Locally, everything works. But when connecting using the proxy, using the CNAME or directly the IP address, I receive the following error:

SSL Error: SSL_write 23995: 1 - error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

I don't even know how to properly debug this problem.

share|improve this question

1 Answer 1

It's most likely the intermediate certificate that your server certificate is chained to. Use curl or openssl instead of a browser to test because browsers not only contain root certificates in their trusted stores now but also intermediate certs, which makes testing with your browser unreliable.

Most of the time, this error is caused because apache is not sending the intermediate certificate back to the client--only the server cert. The root certificate on the client chains to the intermediate cert, not the server cert. The Intermediate cert chains to the server cert.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.