1

After much googling and Serverfault browsing I still have an SSL problem :

Safari can't open the page at all, Firefox gives a "secure connection fail" after 5mn of inactivity (not browsing or anything). Chrome/Chromium return a 403 error then quickly reload the page and everything works.

It happened after installing an SSL certificate by Comodo. You can see the report here : https://www.ssllabs.com/ssltest/analyze.html?d=marketplace.mercicapitaine.fr&hideResults=on

SSL Shopper is all good : https://www.sslshopper.com/ssl-checker.html#hostname=marketplace.mercicapitaine.fr

TLS is 1.2 SSLlabs says : "The server does not support Forward Secrecy with the reference browsers." and "This server supports weak Diffie-Hellman (DH) key exchange parameters."

I did a TCPdump, but i'm having a hard time understanding it..

I'm not a server guy so any tips on how to debug/trace error is welcome. It's hosted on NGINX, nothing special on the error log.

Thanks a lot in advance for your time :)

Edit: nginx config:

server {
    listen *:80;
    listen *:443 ssl;
    ssl_certificate /home/ubuntu/ssl_2016/ssl-bundle.crt;
    ssl_certificate_key /home/ubuntu/ssl_2016/mckey.key;
    server_name marketplace.mercicapitaine.fr;

    access_log /var/log/nginx/marketplacemercicapitainefr.access.log;
    error_log /var/log/nginx/marketplacemercicapitainefr.error.log;

    root /srv/marketapp/;
    index index.html index.htm index.php;

    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 16k;
    fastcgi_read_timeout 900;


    client_max_body_size 50M;

if ($scheme = http) {
        return 301 https://$server_name$request_uri;
}

# This order might seem weird - this is attempted to match last if rules below fail.
location / {
        try_files $uri $uri/ /index.php?$args;
}

# Add trailing slash to */wp-admin requests.
rewrite /wp-admin$ $scheme://$host$uri/ permanent;

# Directives to send expires headers and turn off 404 error logging.
location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
       access_log off; log_not_found off; expires max;
}
location = /favicon.ico {
        log_not_found off;
        access_log off;
}

location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|wmv|3gp|avi|mpg|mpeg|mp4|flv|mp3|mid|wml|swf|pdf|doc|docx|ppt|pptx|zip)$ {
        expires max;
        log_not_found off;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
}

location ~* \.()$ {
        expires 31536000s;
}





    location ~ [^/]\.php(/|$) {



        fastcgi_index index.php;
        include fcgi.conf;
        fastcgi_pass unix:/var/run/ajenti-v-php-fcgi-marketplacemercicapitainefr-php-fcgi-0.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    }
}
  • Either tcpdump text output or openssl s_client -connect <host>:<port> is needed. – drookie Jan 19 '16 at 8:40
  • Here's a tcpdump I did : gist.github.com/anonymous/8501bd0eb86c346fd2bb – Olivier Jan 19 '16 at 8:53
  • Please retake the dump with -nnpi <interface> <server IP> and port 443 arguments. – drookie Jan 19 '16 at 9:28
  • Here's the openssl : gist.github.com/anonymous/0fb5b0531d3c83dec9eb the -nnpi return an argument error, how should it be use ? I can't find much info on this cmd :/ – Olivier Jan 19 '16 at 9:38
  • Are you running on Apache or NGINX? Can you please provide a configuration of the site in question? this would be great to see if there is a possible misconfiguration. Thanks! – semm0 Jan 19 '16 at 11:03
1

After checking the nginx ssl config from the link in your comment, I would change some things in your config. Let me get on it:

server {
   # more_set_headers "Server: my web server :-)";
   listen 80;
   server_name marketplace.mercicapitaine.fr;
   return 301 https://$server_name$request_uri;
}



server {
   # more_set_headers "Server: my web server :-)";

   listen 443 ssl;
   server_name marketplace.mercicapitaine.fr;

   ssl_certificate /home/ubuntu/ssl_2016/ssl-bundle.crt;
   ssl_certificate_key /home/ubuntu/ssl_2016/mckey.key;
   ssl_session_timeout 1d;
   ssl_session_cache shared:SSL:10m;
   # ssl_session_tickets off;

   # openssl dhparam -out dhparam.pem 2048
   # ssl_dhparam /etc/nginx/SSL/dhparams.pem;

   ssl_protocols TLSv1.1 TLSv1.2;
   ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGC$
   ssl_prefer_server_ciphers on;

   add_header Strict-Transport-Security "max-age=15768000;includeSubdomains; preload";

   root /srv/marketapp/;
   index index.html index.htm index.php;

   client_max_body_size 20M;

   location / {
       try_files $uri $uri/ /index.php;
   }

   location ~ \.php$ {
       fastcgi_split_path_info ^(.+\.php)(/.+)$;
       fastcgi_pass unix:/var/run/ajenti-v-php-fcgi-marketplacemercicapitainefr-php-fcgi-0.sock;
       fastcgi_index index.php;
       include fastcgi_params;
   }

   location /doc/ {
       alias /usr/share/doc/;
       autoindex on;
       allow 127.0.0.1;
       deny all;
   }

   location ~/\.ht {
       deny all;
   }
 }
  1. Please think about generating at least 2048 bit Diffie-Hellman parameters.
  2. this config above tries to adopt most of your settings and path, please review it to make sure it's correct.
  3. I'm doing a rewrite from port 80 to port 443 via permanent redirect
  4. non ssl / ssl sections split up
  5. see SSLLabs to check your webpage and see, if there are any additional security options you can set up.

I assume you want do setup a wordpress blog.

If there are any questions, please feel free to ask.

  • 1
    Thanks a lot for the explanations, I learned a lot in the process! We now have a A+ rating with SSLlabs and the wordpress is working like a charm. – Olivier Jan 20 '16 at 10:29
  • @Olivier awesome! You can Check your setup with securityheaders.io (sry answering from cellphone). – semm0 Jan 20 '16 at 10:31
  • Thanks for this! Please note that in your example config the 'ssl_ciphers' line is cut short and therefor will give an error when copy and pasted in a nginx conf. – Gumbah Sep 7 '17 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.