4

I am getting the following error on a site I've just setup in Apache 2:

SSL received a record that exceeded the maximum permissible length

The fixes I've seen around suggest that a fix is to be sure the default-ssl site is enabled, which I have done, but am still getting the error.

7

That usually means that you are sending a HTTPS request to a HTTP service. The message is from the browser complaining that it was unable to to complete the SSL handshake that it was expecting.

do you have

SSLEngine on

configured for that vhost?

  • I've found a thread on StackOverflow that solved the problem. stackoverflow.com/questions/119336/…. Specifically, changing my default-ssl config from <VirtualHost 123.456.789.0:443> to <VirtualHost default:443> – evanmcd Apr 16 '12 at 7:31
  • you probably need to post your vhost config apachectl -S , and also the output from netstat -lntp (this is linux right?) – Tom H Apr 16 '12 at 7:31
0

Re: changing from <VirtualHost 123.456.789.0:443> to <VirtualHost default:443>, I found exactly the opposite w/Apache 2.2.15 on CentOS6; when I changed from <VirtualHost _default_:443> to <VirtualHost 123.456.789.0:443>;

I received an error at Apache restart:

[error] VirtualHost 123.456.789.0:443 -- mixing * ports and non-* ports with a NameVirtualHost address is not supported, proceeding with undefined results

yet the cert was served and once an exception was applied the site loaded.

It's all frelling magic...

0

a before-after of my .cfg file
I had this problem, and eventually figured it out to work in my situation.

What I changed:

  • Defaults: mode & option.
  • Frontend: bind & stats uri (I had a typo).
  • Backend: changed :80 to :443 (this is where my problem was).

Good luck!

0

It's possible to get this error if your virtual host configuration is incomplete and relies on ssl.conf (vendor installed) to do the setup for you. For example if you have a something like this (RHEL7/httpd 2.4):

/etc/httpd/conf.d/confluence.conf

<VirtualHost *:443>
    ServerName  localhost.localdomain
    DocumentRoot /var/www/html
</VirtualHost>

/var/www/html/index.html

helo

Then because confluence.conf is alphabetically before ssl.conf, the SSL virtual host will not yet have been evaluated and httpd will use port 443 to serve unencrypted data, which you can prove like this:

[root@localhost ~]# curl https://localhost.localdomain 
curl: (35) SSL received a record that exceeded the maximum permissible length.
[root@localhost ~]# curl http://localhost.localdomain:443   
helo

In this case we can see the second curl works because the connection on port 443 is speaking plain http.

If we rename confluence.conf to be alphabetically after ssl.conf, then the SSL port will have been setup and it all starts working, eg:

[root@localhost vagrant]# curl https://localhost.localdomain -k
curl: (35) SSL received a record that exceeded the maximum permissible length.
[root@localhost vagrant]# mv /etc/httpd/conf.d/confluence.conf /etc/httpd/conf.d/t.conf         
[root@localhost vagrant]# systemctl restart httpd
[root@localhost vagrant]# curl https://localhost.localdomain -k
helo

My recommendation to fix this would be to configure mod_ssl within the VirtualHost directive:

<VirtualHost *:443>
    ...
    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>

Alternatively, renaming the file containing the VirtualHost definition to come alphabetically after ssl.conf will will work but this technique can be easily overlooked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.