Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to encrypt my site using SSL. I created a self-signed certificate (in the interim) and am attempting to integrate it into my nginx server.

I placed the certificate into the main nginx.conf file, as I have multiple domains (dev and beta).

# SSL
ssl_certificate     /srv/ssl/nginx.pem;
ssl_certificate_key /srv/ssl/nginx.key;
ssl_session_cache   shared:SSL:10m;
ssl_session_timeout 10m;

In the server block, I have the following:

+server {
+   listen 80;
+   server_name dev.DOMAIN.com;
+
+   location / {
+       rewrite ^ https://$server_name$request_uri permanent;
+   }
+}

server {
+   listen 443 ssl;
    server_name dev.DOMAIN.com;

    access_log /var/www/dev/logs/access.log;
    error_log /var/www/dev/logs/error.log;
    root /var/www/dev/public_html;
+   keepalive_timeout   70;

    location / {
        index  index.html index.htm index.php;
    }

    // [.. A couple other rewrite statements here ..]
}

I made the same changes to the server block for my beta build, but while it works in the dev build, I am receiving Connection Refused errors on the beta build.

I've verified that both dev and beta files are identical (except for the subdomain).

The code on both builds is identical as well. Neither the error log nor the access log show any entries.

I honestly have no idea where to go next...!

share|improve this question
    
Can you define what "refusing connections" means? Is the port closed? Is the SSL connection returning an error? –  Andrew M. May 9 '12 at 18:28
    
Hi @AndrewM., when I try to access the site, Firefox says that a connection cannot be established. When I try to wget the site, the message "Connection Refused" is returned. I believe it is an nginx erorr? –  Julian H. Lam May 9 '12 at 18:50
    
I can't imagine the port would be closed, as both dev and beta are hosted on the same machine. SSL on the dev build works, while the beta doesn't. –  Julian H. Lam May 9 '12 at 18:51
    
Working down the OSI stack, is the port open and accessible? Try telnetting to 443 and see if you're able to establish a connection (note that windows telnet doesn't necessarily open a connection even though it may look open on the console). –  bangdang May 9 '12 at 18:54
1  
julian@julian-work:~$ telnet 50.116.54.128 443 \ Trying 50.116.54.128... \ Connected to 50.116.54.128. –  Julian H. Lam May 9 '12 at 19:30

1 Answer 1

Note: The answer pertains specifically to my issue. If you are experiencing a similar problem, please read the comments for the original question, as they are probably more relevant

As it turned out, CloudFlare interferes with SSL websites unless they are specifically configured to be as such. For my case, the dev subdomain was set to bypass the CloudFlare network completely, while beta was "accelerated", which caused the IP to shift to CloudFlare's IP.

Cloudflare does offer SSL support for the free accounts if you create a subdomain named "ssl". Further support requires the pro version (~$20/mo).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.