I just installed an SSL cert and set up Nginx with the secure directives.

Here's all the output. but if you go to https://app.clearpointcreditcounselingsolutions.org, nothing happens. I'm totally stumped!

server {
    listen                  80;
    listen                  443 default ssl;
    server_name             app.clearpointcreditcounselingsolutions.org;

    ssl on;
    ssl_certificate        ****.crt;
    ssl_certificate_key     ****key;

$> netstat -tulpn | grep 443
tcp        0      0       *                   LISTEN      24389/nginx.conf 

$> nmap  | grep 443
443/tcp  open  https

$> openssl s_client -connect localhost:443
depth=3 L = ValiCert Validation Network, O = "ValiCert, Inc.", OU = ValiCert Class 2 Policy Validation Authority, CN = http://www.valicert.com/, emailAddress = info@valicert.com
verify return:1
depth=2 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certificates.godaddy.com/repository, CN = Go Daddy Secure Certification Authority, serialNumber = *******
verify return:1
depth=0 O = app.clearpointcreditcounselingsolutions.org, OU = Domain Control Validated, CN = app.clearpointcreditcounselingsolutions.org

[..and on it goes, but does not belong here..]

All that looks like it checks out. What am I missing? What other tests can i run?

Thanks, tom

EDIT: Thanks to the help below, I was able to diagnose that the issue was with iptables, and was fixed by adding the following:

-A INPUT -p tcp -s 0/0 --sport 1024:65535 -d $server_ip_address --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 14 -A OUTPUT -p tcp -s $server_ip_address --sport 443 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
  • have you checked the error log for this host yet?
    – Mike
    Mar 12 '12 at 13:16
  • show output from iptables -L -n -v
    – B14D3
    Mar 12 '12 at 13:28
  • Yes, there is nothing in the error log. :-/ Mar 12 '12 at 13:28

It looks like its working locally but you may have a firewall rule in place thats blocking it from outside.

I can connect to your server on port 80 but get straight cutoff trying to make a connection on 443.

This is what i normally use to check SSL cert's when i am setting them up: http://www.sslshopper.com/ssl-checker.html#hostname=app.clearpointcreditcounselingsolutions.org

  • How can I find out where the block is and lift it? I did not set up this server originally, so I do not know what was implemented when it was built. Mar 12 '12 at 13:28
  • You would need to know how the server is connected within your network. I mean does the server have a public address or is it on a local address with NAT?
    – JTotham
    Mar 12 '12 at 13:29
  • If you run ifconfig you should see all the network interfaces the server has, if one of them has as its address you are using public addressing and you would need to find out what router is connecting your server to the internet. If one has a or simular address then your server is using a local IP address and has its connections NAT'd to it by a router.
    – JTotham
    Mar 12 '12 at 13:32
  • Once you find out what the servers local address is then you can redo your nmap test against that address instead of or localhost to see if the local computer is firewalling the connection. If you can 'openssl s_client -connect LOCALIP:443' and get a good connection then the firewall will be on your router and you would need to find out who manages that.
    – JTotham
    Mar 12 '12 at 13:35
  • Thank you for the full explanation. I'll look into all of this! Mar 12 '12 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.