Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've looked at some examples but I really can't figure out why ssl wont work. My situation:

First of all I have a rails application with passenger, the normal application works with nginx, no problem there. I would like to add ssl support on some paths (for example /admin or /config). I've self signed my certificate because the url's will be used by a android application to send data secure to the server, this is the only reason why I need SSL support.

From what I understand is that I should enable both HTTP and HTTPS on nginx and let the rails application decide whether to use HTTP or HTTPS (correct me if I'm wrong). So how should my nginx configuration look like to allow both HTTPS and HTTP on the same IP/address? I've used the following command's to generate my certificates:

openssl req –new -x509 –keyout private/cakey.pem –out cacert.pem
openssl req –new –out newcert/webserver-cert/pem –keyout private/webserver-key.pem
echo '01' > serial
touch index.txt
openssl ca –cert cacert.pem –keyfile private/cakey.pem –out certs/webserver-cert.pem –in newcerts/webserver-cert.pem

Now I dont know if this is the right way to do it, any help on this would also be welcome :)



This is my current configuration, when I use https I get the following error: "SSL connection error"

root@event-backend:/opt# cat /opt/nginx/conf/nginx.conf

worker_processes 1;
error_log  logs/error.log  info;

#pid        logs/;

events {
    worker_connections  1024;

http {
    passenger_root /usr/local/rvm/gems/ruby-1.9.3-p194@rails32/gems/passenger-3.0.12;
    passenger_ruby /usr/local/rvm/wrappers/ruby-1.9.3-p194@rails32/ruby;

    include       mime.types;
    default_type  application/octet-stream;

    #access_log  logs/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

   server {
        listen 80;

        root /opt/bap-backend/public;

        location ~ .php$ {
                fastcgi_split_path_info ^(.+\.php)(.*)$;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME /opt/www$fastcgi_script_name;
                include fastcgi_params;

        passenger_enabled on;

   server {
        listen 443 ssl;

        root /opt/bap-backend/public;

        #SSL options
        ssl_certificate         /opt/certificate/server.crt;
        ssl_certificate_key     /opt/certificate/server.key;

        location / {
                proxy_set_header X-FORWARDED_PROTO $scheme;
        ssl_session_timeout 5m;
        ssl_protocols SSLv2 SSLv3 TLSv1;
        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

        passenger_enabled on;


Is this normal or is this because I didnt change anything in my rails application?


root@event-backend:/opt# netstat --tcp --listening --programs
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 localhost.localdom:smtp *:*                     LISTEN      392/sendmail: MTA:
tcp        0      0 *:https                 *:*                     LISTEN      8799/nginx
tcp        0      0 localhost.localdo:mysql *:*                     LISTEN      226/mysqld
tcp        0      0 localhost.lo:submission *:*                     LISTEN      392/sendmail: MTA:
tcp        0      0 *:www                   *:*                     LISTEN      8799/nginx
tcp        0      0 *:ssh                   *:*                     LISTEN      213/sshd
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      213/sshd

root@event-backend:/opt# cat nginx/logs/error.log

2012/05/11 07:44:29 [notice] 1562#0: signal 15 (SIGTERM) received, exiting
2012/05/11 07:44:29 [notice] 1564#0: exiting
2012/05/11 07:44:29 [notice] 1564#0: exit
2012/05/11 07:44:29 [notice] 1562#0: signal 17 (SIGCHLD) received
2012/05/11 07:44:29 [notice] 1562#0: worker process 1564 exited with code 0
2012/05/11 07:44:29 [notice] 1562#0: exit
2012/05/11 07:44:29 [notice] 8756#0: using the "epoll" event method
2012/05/11 07:44:29 [notice] 8756#0: nginx/1.0.15
2012/05/11 07:44:29 [notice] 8756#0: built by gcc 4.4.3 (Ubuntu 4.4.3-4ubuntu5)
2012/05/11 07:44:29 [notice] 8756#0: OS: Linux 2.6.32-6-pve
2012/05/11 07:44:29 [notice] 8756#0: getrlimit(RLIMIT_NOFILE): 1024:1024
2012/05/11 07:44:29 [notice] 8799#0: start worker processes
2012/05/11 07:44:29 [notice] 8799#0: start worker process 8801

root@event-backend:/opt/nginx/sbin# ./nginx -V
nginx version: nginx/1.0.15
built by gcc 4.4.3 (Ubuntu 4.4.3-4ubuntu5)
TLS SNI support enabled
configure arguments: --prefix=/opt/nginx --with-http_ssl_module --with-http_gzip_static_module --with-cc-opt=-Wno-error --add-module=/usr/local/rvm/gems/ruby-1.9.3-p194@rails32/gems/passenger-3.0.12/ext/nginx --with-http_ssl_module


There was a firewall doing some crazy stuff, now I can use https but I find in my logs the following errors:

root@event-backend:/opt# cat nginx/logs/error.log

2012/05/11 12:48:15 [info] 14713#0: *229 client closed prematurely connection while SSL handshaking, client:, server:
2012/05/11 12:48:15 [info] 14713#0: *230 client closed prematurely connection while SSL handshaking, client:, server:
2012/05/11 12:48:15 [error] 14713#0: *231 directory index of "/opt/bap-backend/public/" is forbidden, client:, server:, request: "GET / HTTP/1.1", host: ""
share|improve this question
up vote 2 down vote accepted

All you need is a second server { block that's configured for SSL on port 443.

You'll want a listen 443 ssl; directive and directives pointing to your public and private keys; ssl_certificate /path/to/webserver-cert.pem; and ssl_certificate_key /path/to/webserver-key.pem;.

share|improve this answer
What about the server_name and root? should I re add them or define them again or something or just make a new server and only specifie the ssl parameters? – DanFritz May 10 '12 at 8:37
You'll want the base config from the original server block as well. – Shane Madden May 10 '12 at 15:19
I've added my configuration, I still have an error, can you look at it? Thanks alot! – DanFritz May 10 '12 at 20:58
Looks good. Any errors in the nginx log? Verify that it's listening on 443 with netstat? – Shane Madden May 10 '12 at 21:35
I've added the logs and also the error messages from different browsers, firefox errors seems to point at something. – DanFritz May 11 '12 at 5:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.