Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just installed an SSL cert and set up Nginx with the secure directives.

Here's all the output. but if you go to https://app.clearpointcreditcounselingsolutions.org, nothing happens. I'm totally stumped!

server {
    listen                  80;
    listen                  443 default ssl;
    server_name             app.clearpointcreditcounselingsolutions.org;

    ssl on;
    ssl_certificate        ****.crt;
    ssl_certificate_key     ****key;
    ....
}

$> netstat -tulpn | grep 443
tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      24389/nginx.conf 

$> nmap 127.0.0.1  | grep 443
443/tcp  open  https

$> openssl s_client -connect localhost:443
depth=3 L = ValiCert Validation Network, O = "ValiCert, Inc.", OU = ValiCert Class 2 Policy Validation Authority, CN = http://www.valicert.com/, emailAddress = info@valicert.com
verify return:1
depth=2 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certificates.godaddy.com/repository, CN = Go Daddy Secure Certification Authority, serialNumber = *******
verify return:1
depth=0 O = app.clearpointcreditcounselingsolutions.org, OU = Domain Control Validated, CN = app.clearpointcreditcounselingsolutions.org

[..and on it goes, but does not belong here..]

All that looks like it checks out. What am I missing? What other tests can i run?

Thanks, tom

EDIT: Thanks to the help below, I was able to diagnose that the issue was with iptables, and was fixed by adding the following:

-A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $server_ip_address --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 14 -A OUTPUT -p tcp -s $server_ip_address --sport 443 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
share|improve this question
    
have you checked the error log for this host yet? –  Mike Mar 12 '12 at 13:16
    
show output from iptables -L -n -v –  B14D3 Mar 12 '12 at 13:28
    
Yes, there is nothing in the error log. :-/ –  Tom Thorogood Mar 12 '12 at 13:28

1 Answer 1

up vote 1 down vote accepted

It looks like its working locally but you may have a firewall rule in place thats blocking it from outside.

I can connect to your server on port 80 but get straight cutoff trying to make a connection on 443.

This is what i normally use to check SSL cert's when i am setting them up: http://www.sslshopper.com/ssl-checker.html#hostname=app.clearpointcreditcounselingsolutions.org

share|improve this answer
    
How can I find out where the block is and lift it? I did not set up this server originally, so I do not know what was implemented when it was built. –  Tom Thorogood Mar 12 '12 at 13:28
    
You would need to know how the server is connected within your network. I mean does the server have a public address or is it on a local address with NAT? –  JTotham Mar 12 '12 at 13:29
    
If you run ifconfig you should see all the network interfaces the server has, if one of them has 50.57.234.6 as its address you are using public addressing and you would need to find out what router is connecting your server to the internet. If one has a 192.169.0.1 or simular address then your server is using a local IP address and has its connections NAT'd to it by a router. –  JTotham Mar 12 '12 at 13:32
    
Once you find out what the servers local address is then you can redo your nmap test against that address instead of 127.0.0.1 or localhost to see if the local computer is firewalling the connection. If you can 'openssl s_client -connect LOCALIP:443' and get a good connection then the firewall will be on your router and you would need to find out who manages that. –  JTotham Mar 12 '12 at 13:35
    
Thank you for the full explanation. I'll look into all of this! –  Tom Thorogood Mar 12 '12 at 13:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.