-4

I've been trying to configure SSL on my server for last 4 days now, with absolutely no success. I've generated a CSR file and uploaded the certificate and configured a Vhost, but nothing seems to work. I don't get any errors when I restart Apache and error log doesn't have anything in it.

When I talked to my certificate provider to see if they can help they said " We are unable to connect to the server "example.com" through the port#443. Please ensure that the port#443 is open on your external firewall to enable SSL. "

When I ran UFW Status to see if the port was open I got following result, which seems to show it is open.

   To                         Action      From
--                         ------      ----
443/tcp                    ALLOW       Anywhere
22                         ALLOW       Anywhere
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
21/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere (v6)
22                         ALLOW       Anywhere (v6)
22/tcp                     ALLOW       Anywhere (v6)
80/tcp                     ALLOW       Anywhere (v6)
21/tcp                     ALLOW       Anywhere (v6)

443/tcp                    ALLOW OUT   Anywhere
443/tcp                    ALLOW OUT   Anywhere (v6)

When I use online port checker website to see if it is open, it shows 443 closed and every other port in the list to be open. At this point I have no idea what else to do to open port 443, some help would be much appreciated. I am running Ubuntu.

1 Answer 1

3

First off, verify that you can connect from your local machine... you can just telnet to port 443, both on localhost (127.0.0.1) as well as on your machine's IP address. You should at least get an answer (ie. verification that there is a listener on that port).

Example - This is what you do not want:

$ telnet 127.0.0.1 443
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

Example - This confirms something is listening (as it says, you can use control right-bracket to get back to the telnet prompt):

$ telnet 127.0.0.1 443
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
^]
telnet> quit
Connection closed.

Note: You can also "short circuit" this approach with just checking netstat... you're mostly just looking for the "LISTEN" state:

$ netstat -antl | grep 443
tcp        0      0 127.0.0.1:52421         127.0.0.1:443           TIME_WAIT
tcp6       0      0 :::443                  :::*                    LISTEN

To actually check the SSL handshake, you can use openssl:

$ openssl s_client -connect 127.0.0.1:443
CONNECTED(00000003)
...

You should be able to check similar items from the outside... particularly seeing if the port is open or you can complete an SSL handshake.

Note: If your local network is on a non-public IP space (eg. RFC1918 network addresses), that implies that there is a NAT somewhere in front of your machine... generally on the router. These addresses at 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. If this is the case, you'll also have to open and/or forward the address on your router or network firewall.

8
  • Thank you for you response I ran $ telnet 127.0.0.1 443 I got following response as you indicated $ telnet 127.0.0.1 443 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. When I can ran netstat -antl | grep 443 I got this tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN to check ssl handshake I ran the cmd you suggested openssl s_client -connect 127.0.0.1:443 and received CONNECTED (00000003)
    – DN0300
    Mar 26, 2015 at 22:58
  • Every test that you suggest I ran and It seems like I can access the port 443 but people from outside can't I have no problems with any of the other ports I mentioned above. Could this be a problem with IPtables?
    – DN0300
    Mar 26, 2015 at 23:07
  • This could be an IPTables issue... but, going to your own IP address should help verify that it's likely something else. Note, you can get your IP address by using ifconfig -a (that's in /usr/sbin or /sbin, in case it's not in your path). Also, please confirm your host is not on an RFC1918 (AKA private) network. If it is in that range, you have at least one other router to fix or port-forward.
    – RVT
    Mar 26, 2015 at 23:11
  • No I don't think it is an RFC1918 Networt. Again how can I verify that?
    – DN0300
    Mar 26, 2015 at 23:20
  • See my above comment(s)... use ifconfig -a and look at the quad-dotted IP Address on your ethernet and/or wireless card. If it falls in to the ranges 10.0.0.0 - 10.255.255.255, 172.16.0.0. - 172.31.255.255 or 192.168.0.0 - 192.168.255.255, then it's a private network.
    – RVT
    Mar 26, 2015 at 23:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.