3

I have a development version of a Django website with domain name "mysite.com" I used to access my site via the URL "http://web01.mysite.com". I've just installed a wildcard digital certificate and now I can't reach the site. If I use either "https://web01.mysite.com" or "http://web01.mysite.com", I get a quick "ERR_CONNECTION_REFUSED" message. I've read Nginx's SSL doc, numerous blog posts on setting up SSL on Nginx, and researched this error but I can't figure out what's wrong.

My server is Debian 8.7. I'm running Nginx 1.6.2 and "--with-http_ssl_module" is one of the configure arguments. I'm also using the default nginx.conf file. The nginx process runs under the default account 'www-data'.

My certificate and private key file are located in this directory:

drwr-xr-x   root  root  /srv/ssl/mysite.com/

Here are my bundled certficate and private key files which reside in the above directory:

-r--r-----  root  www-data  ssl-bundle.crt
-r--r-----  root  www-data  mysite.com.key

When I configured the wildcard certificate, I specified "*.mysite.com" as the Common Name.

Here is my /etc/nginx/sites-enabled/mysite.conf file:

server_tokens off;
upstream gunicorn {
    server 127.0.0.1:8000 fail_timeout=0;
}

server {
    #listen 80;
    listen 443 ssl;
    server_name web01.mysite.com;
    ssl_certificate /srv/ssl/mysite.com/ssl-bundle.crt;
    ssl_certificate_key /srv/ssl/mysite.com/mysite.com.key;

    location / {
        root /srv/http/mysite.com/repo;

        # Redirect all HTTP requests to HTTPS
        rewrite ^ https://$server_name$request_uri permanent;
    }

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    client_max_body_size 4G;
    keepalive_timeout 5;

    # Pass static file requests to the file server
    location /static/ {
        proxy_pass http://45.33.33.53;
    }
    location /media/ {
        alias /var/www/mysite.com/media/;
    }

    try_files $uri @django;

    location @django {
        proxy_pass http://gunicorn;
        proxy_redirect off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;

        # Capture originating IP address of client
        # This allows me to view the HTTP_X_FORWARDED_FOR field in request.META
        # in my login_firewall view.
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

I've opened up port 443 on my firewall:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  loopback/8           anywhere             reject-with icmp-port-unreachable
ACCEPT     icmp --  anywhere             anywhere             state NEW icmp echo-request
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh state NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http state NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https state NEW
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables_INPUT_denied: "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables_FORWARD_denied: "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

If I do "sudo netstat -plnt | grep nginx", I can see Nginx is listening on port 443:

tcp   0   0 0.0.0.0:443   0.0.0.0:*   LISTEN    25537/nginx -g daem

I've checked the nginx error log (with debug on) and it's empty. I did reload the nginx config files after I changed them.

Does ssl.conf need to be included from either nginx.conf or my mysite.conf file? This answer mentions that as a requirement but I didn't see this discussed in the Nginx docs nor in any of the configuration articles I read online.

Does anyone see what I'm doing wrong?

4
  • Remove the https redirect from location / block, could cause a loop. A few things to try. 1) "service iptables stop" (or similar). 2) Add a server block for http/80 to test general connectivity 3) Curl from the instance to http and https, with and without -k "ignore SSL problems" option 4) Curl from a remote machine with/without -k
    – Tim
    Commented Jan 31, 2017 at 23:14
  • You could increase nginx log level to debug, that might tell you whats happening there. If your nginx version was compiled with debug log it's just this line: error_log /var/log/nginx/error.log; More info: nginx.org/en/docs/debugging_log.html Commented Jan 31, 2017 at 23:17
  • @Tim Interesting. If I comment out the rewrite line in the location block and enter https:// web01.mysite.com I do get the green "Secure" icon in the URL window but now I get "403 Forbidden". Error log says "/srv/http/mysite.com/repo/index.html"... directory index of "/srv/http/mysite.com/repo" is forbidden. Do I have to set an "index" directive now that I'm using SSL? Not sure what that would be for a Django project.
    – Jim
    Commented Feb 1, 2017 at 1:00
  • Do you have web01.mysite.com anywhere else in your config files? Commented Feb 1, 2017 at 11:46

1 Answer 1

0

It looks like you're redirecting from https to https causing a redirection loop. I don't know why you'd be getting a connection refused message from that, but your comment above confirms this.

Your second problem, 403 Forbidden, is likely a permissions issue. Does the user Nginx is running as (user directive in nginx.conf) have permission to the resources that the applicable location block is referencing?

3
  • I have a separate file server fs01.mysite.com that serves static files (e.g. the CSS stylesheet that's referenced by every page). I haven't installed and configured SSL and Nginx on that server yet. Could that be the problem, that my pages are referencing resources on an external, non-SSL server? I wanted to get SSL working on my webserver such that I could at least render the home page before configuring my fileserver. I'm also going to examine this from the point of view of Django. The problem may have moved there now.
    – Jim
    Commented Feb 1, 2017 at 3:37
  • By the way, the Nginx user 'www-data' does have read-access to all of the files in the Nginx root location so I don't think that's it.
    – Jim
    Commented Feb 1, 2017 at 3:40
  • Yes, I was looping back on myself. I now have another problem which is preventing this from working but at least I'm past this one.
    – Jim
    Commented Feb 1, 2017 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .