I have two servers behind an ELB on AWS. I am using Lets Encrypt newest wildcard SSL feature but I'm running into the following error ERR_SSL_PROTOCOL_ERROR the strange part is that sometimes it will work and sometimes it doesn't.

I generated the site using the following command with the latest certbot

./certbot-auto certonly \                                    
--manual \
--preferred-challenges=dns \
--email tech@example.com \
--server https://acme-v01.api.letsencrypt.org/directory \
--agree-tos \
-d *.example.net

Here is my output from curl as well

curl -v https://admin.example.net
* Rebuilt URL to: https://admin.example.net/
*   Trying xxx.xxx.xxx.xxx...
* Connected to admin.example.net (xxx.xxx.xxx.xxx) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

any idea why it is an unknown protocol? Ironically my frontend server that isn't behind the load balancer is working

  • You've left your IP in the logs above. I've tried connecting it, guessing domain by DNS RRs (admin.ba****s.net, right?). And I've succeeded, but got this error from backend: HTTP/1.1 503 Service Unavailable: Back-end server is at capacity Whats your curl version? Can you try openssl s_client -connect HOST:PORT? – NStorm Feb 4 '20 at 7:56
  • It works now, 302 redirecting me to /admin/login – NStorm Feb 4 '20 at 7:58
  • @NStorm very strange. I just tested on mobile not connected to wifi and it works. but my office wifi breaks it... might just be a china internet problem – NooBskie Feb 4 '20 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.