1

I am trying to configure SSL on my localhost using Nginx. I created a self-signed certificate and my Nginx configuration is as below:

server {
  listen 443 ssl;
  server_name localhost;

  root /usr/share/nginx/html;
  index index.html index.htm;

  ssl on;
  ssl_certificate /etc/nginx/ssl/nginx.crt;
  ssl_certificate_key /etc/nginx/ssl/nginx.key;

  ssl_session_timeout 5m;

  ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
  ssl_prefer_server_ciphers on;

  location / {
        try_files $uri $uri/ =404;
  }
}

But when I try accessing it gives me following error

$ curl -i https://localhost            
  curl: (7) Failed to connect to localhost port 443: Connection refused

What could be the possible cause for this error?

This is the output of command 'netstat -tuplen'

tcp    0     0 0.0.0.0:443     0.0.0.0:*      LISTEN     0    71662       - 
  • did you restart nginx after changing the configuration? are you sure the configuration file is actually loaded? – Gerald Schneider Dec 14 '16 at 7:09
  • @GeraldSchneider I have restarted the nginx and there is no error logged in the log file. – Sunil Antony Dec 14 '16 at 7:23
  • 2
    is localhost resolving the correct ip address? – Gerald Schneider Dec 14 '16 at 7:43
  • 1
    also there could be iptables rules blocking such requests. – dr-evil Dec 14 '16 at 7:56
  • Do you have other nginx server blocks? If it won't affect anything try adding default_server to the end of the server_name line. I'm not confident it will fix it but it's an investigative step. – Tim Dec 14 '16 at 8:05
1

You are missing a listen directive:

listen [::]:443 ssl;

This tells nginx to listen for IPv6 connections. Your existing listen directive listens only for IPv4 connections, and this is borne out in your netstat output.

The reason this is required (in addition to the existing listen directive) is that localhost resolves to an IPv6 address ::1 in addition to the historic IPv4 address 127.0.0.1. But, IPv6 is the preferred protocol for making connections. Thus curl is attempting to connect to nginx via IPv6 and failing.

Of course, on the global Internet which you will (probably) eventually put your site on, you also will have to use IPv6, either now or in the near future. So you should prepare for this today.

  • This issue was related to iptable rules. Some rules were blocking port 443. I fixed it. Also your suggestion is considerable for the improvement. Thank you. – Sunil Antony Dec 15 '16 at 10:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.