1

I was trying to diagnose a problem where any HTTPS request to my VPS returns with ERR_CONNECTION_CLOSED. I'm using Let's Encrypt implemented on NGINX while the web server itself is a Node.js app.

The website is served under a specific subdomain, let's just say it is mysub.domain.com.

Here's what an Nmap scan on the mysub.domain.com comes up with:

443/tcp  open     https?

And here's what a similar scan on the public IP address comes up with:

443/tcp  closed   https

My VPS doesn't have any firewall yet, at least in the host itself. Here's the output of iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

UPDATE Here's the output of netstat -tlpdn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      367/sshd        
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      7283/nginx -g daemo
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      773/mysqld      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      7283/nginx -g daemo
tcp6       0      0 :::22                   :::*                    LISTEN      367/sshd        
tcp6       0      0 :::8080                 :::*                    LISTEN      5873/nodejs     

UPDATE Here's the NGINX's sites-available/default contents

server {
    listen 443 ssl;

    server_name mysub.domain.com;

    ssl_certificate /etc/letsencrypt/live/mysub.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mysub.domain.com/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_stapling on;
    ssl_stapling_verify on;
    add_header Strict-Transport-Security max-age=15768000;

    location / {
        proxy_pass http://localhost:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

server {
    listen 80;
    server_name mysub.domain.com;
    return 301 https://$host$request_uri;
}

The admin on the facility which houses the VPS tells me that they have opened port 443. Are they missing something? Or is it a mistake on my part?

  • Please show output for netstat -tldpn – Alexander Tolkachev Jul 11 '17 at 13:28
  • @AlexanderT I've added that. – starleaf1 Jul 11 '17 at 14:39
  • Please show your nginx configuration. – Tero Kilkanen Jul 11 '17 at 16:19
  • @TeroKilkanen I've added that. – starleaf1 Jul 11 '17 at 16:40
  • What is the difference between public IP and mysub.domain.com? – Tero Kilkanen Jul 11 '17 at 16:42
0

As it turned out, the admin did miss something. The facility implements some weird NAT/IP-forwarder thingy and they forgot to forward traffic in port 443 to my VPS.

  • these kind of issues should be thouroughly "debuged" with tcpdump for example. So if you do not see any traffic on the servers when HTTPS requested from outside, you will know that something before your server is blocking traffic. – titus Jan 6 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.