5

First of all, what do I have:

OpenSSL 1.0.1e-fips 11 Feb 2013
nginx version: nginx/1.6.2
CentOS Linux release 7.0.1406 (Core)

and, for testing purposes, a self-signed certificate:

openssl req -x509 -sha256 -newkey rsa:2048 -keyout private_key.pem -out certificate.pem -days 365
openssl rsa -in private_key.pem -out certificate_key.pem
openssl dhparam -out dhparam.pem 4096

So, the problem is following - when I open test.example.com in browser, I get ERR_CONNECTION_RESET. In the nginx error log I see following:

2015/02/07 03:18:34 [error] 27951#0: *17 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking, client: my.computers.ip.address, server: 0.0.0.0:443

My /etc/nginx/nginx.conf -

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user  nginx;
worker_processes  1;

error_log  /path/error_log.log;
#error_log  /var/log/nginx/error.log  notice;
#error_log  /var/log/nginx/error.log  info;

pid        /run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /path/access_log.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    index index.php index.html index.htm;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80 default_server;
        listen       443 default ssl;
        server_name  localhost;
        root         /usr/share/nginx/html;

        #charset koi8-r;

        #access_log  /var/log/nginx/host.access.log  main;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        }

        # redirect server error pages to the static page /40x.html
        #
        error_page  404              /404.html;
        location = /40x.html {
        }

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
        }
    }
}

My /etc/nginx/conf.d/test.example.com.conf -

upstream php-handler {
  server 127.0.0.1:9000;
  #server unix:/var/run/php5-fpm.sock;
  }

server {
  listen 80;
  server_name test.example.com;
  # enforce https
  return 301 https://$server_name$request_uri;
  }

server {
  listen 443 ssl;
  server_name test.example.com;

  ssl on;
  ssl_certificate_key /path/certificate_key.pem;
  ssl_certificate /path/certificate.pem;

  ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL';

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_session_cache shared:SSL:10m;

  ssl_stapling on;
  ssl_stapling_verify on;
  resolver 8.8.4.4 8.8.8.8 valid=300s;
  resolver_timeout 10s;

  ssl_prefer_server_ciphers on;
  ssl_dhparam /path/dhparam.pem;

  add_header Strict-Transport-Security max-age=63072000;
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;

  # Path to the root of your installation
  root /usr/share/owncloud/;
  # set max upload size
  client_max_body_size 10G;
  fastcgi_buffers 64 4K;

  rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
  rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
  rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;

  error_page 403 /core/templates/403.php;
  error_page 404 /core/templates/404.php;

  location = /robots.txt {
    allow all;
    log_not_found off;
    access_log off;
    }

  location ~ ^/(?:\.htaccess|data|config|db_structure\.xml|README){
    deny all;
    }

  location / {
   # The following 2 rules are only needed with webfinger
   rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
   rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

   rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
   rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;

   rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;

   try_files $uri $uri/ /index.php;
   }

   location ~ \.php(?:$|/) {
   fastcgi_split_path_info ^(.+\.php)(/.+)$;
   include fastcgi_params;
   fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
   fastcgi_param PATH_INFO $fastcgi_path_info;
   fastcgi_param HTTPS on;
   fastcgi_pass php-handler;
   }

   # Optional: set long EXPIRES header on static assets
   location ~* \.(?:jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
       expires 30d;
       # Optional: Don't log access to assets
         access_log off;
   }

  }

If I comment out all SSL related matters from second server block, comment out whole first server block, and put listen 80; into second block, then it works and thus I conclude that problem is related to SSL.

Thus that, I started to search for similar cases. Amongst dozen or so questions I've checked here, the following pair seemed to be particularly relevant:

  1. SSL routines:SSL23_WRITE:ssl handshake failure
  2. OpenSSL handshake failure

From the first question, I figured out that I should try executing openssl s_client -connect test.example.com:443 and openssl s_client -tls1 -connect test.example.com:443.

For the former the result is:

[user@server nginx]# openssl s_client -connect test.example.com:443
CONNECTED(00000003)
140140897699744:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 249 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

For the latter the result is:

[user@server nginx]# openssl s_client -tls1 -connect test.example.com.com:443
CONNECTED(00000003)
140133453146016:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1423271541
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

Given these responses, as well as information from both listed, and a few other questions, as well as some matters mentioned elsewhere, I've concluded following:

  • I may have a bugged OpenSSL version.
  • I may have misconfigured my SSL. In particular, I may have done somethign wrong with cyphers.
  • I may have ran into some form of incompatiblity.

From there onwards, given that migration to another server or wiping the server to rebuild it with other OS is not viable, I think that I have these options:

  • Somehow upgrade OpenSSL on my server to, for example, recently released 1.0.2. The question is compatiblity and how to do it - I seem to have the latest version of OpenSSL to be found on repos I am aware of.
  • Somehow install second OpenSSL isntance, if that is possible, or some OpenSSL alternative, if such exists.
  • Disable encryption, which is not a viable production solution in long-term.

What have I, hopefully, missed? Hopefully, since I'd rather avoid any of fairly radical solutions that I've come up with.

7
  • It looks like you are following this tutorial. While it is otherwise excellent, you should consider using the backward compatibility cipher list, at least for testing. Also make sure that you have installed all available updates for CentOS. Feb 7, 2015 at 1:34
  • Backward-compatiblity ciphers do not solve the core issue, unfortunately. 'Completing the setup' is very vague advice without specifying the setup you are relating to.
    – user185481
    Feb 7, 2015 at 1:40
  • You can start by posting your actual nginx configuration. :) Feb 7, 2015 at 1:43
  • There you go, full nginx.conf and test.example.com.conf.
    – user185481
    Feb 7, 2015 at 1:58
  • 1
    Well, all I can give you at this point is the upvote. :) Feb 7, 2015 at 2:14

2 Answers 2

1

Solved by commenting lines

    listen       80 default_server;
    listen       443 default ssl;

in nginx.conf, so that they become

    #listen       80 default_server;
    #listen       443 default ssl;
2
  • Okay, and what the reason, why do you have to disable the listen commands?
    – sebix
    Feb 11, 2015 at 10:26
  • I am not fluent enough with nginx to explain why exactly it worked out for me, but it would seem that ssl listens from main file did interfere with those from app-specific file.
    – user185481
    Feb 14, 2015 at 11:29
0

I was getting "no ssl_certificate is defined in server listening on SSL port while SSL handshaking", too. In my case, the explanation was much simpler: I was doing "service nginx start" instead of "service nginx restart". Doh!

2
  • You are answering another question. Apr 28, 2015 at 1:13
  • It's an answer to OP's first problem: "no ssl_certificate is defined in server listening on SSL port while SSL handshaking". Just trying to help people who are googling for that error message. Apr 28, 2015 at 3:28

You must log in to answer this question.