I had a fully fonctionnal website on an OVH VPS (debian, apache, SSL). I tried to migrate it to a scaleway VPS. I changed the DNS entries, I copied the apache config files and the certificate files but it did not work. Then I tried to generate a new certificate with letsencrypt, but I still get SSL_ERROR_RX_RECORD_TOO_LONG when I try to connect my website via https.

Here is my apache config file :

Listen 80
Listen 443 https

<VirtualHost mydomain.fr:80>
        ServerName mydomain.fr
        DocumentRoot /var/www/html

<IfModule mod_ssl.c>
<VirtualHost mydomain.fr:443>
        ServerName mydomain.fr
        DocumentRoot /var/www/html

        SSLCertificateFile /etc/letsencrypt/live/mydomain.fr/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.fr/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf


What surprises me is that the certbot script returns a success but the ssllabs.com site diagnoses a problem.

certbot certonly -d mydomain.fr

gives me

Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for mydomain.fr
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/001_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/001_csr-certbot.pem

 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/mydomain.fr/fullchain.pem. Your cert
   will expire on 2017-11-29. To obtain a new or tweaked version of
   this certificate in the future, simply run certbot again. To
   non-interactively renew *all* of your certificates, run "certbot
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
  • 1
    what's in that "/etc/letsencrypt/options-ssl-apache.conf" file? At least try to provide some meaningful info, such as the SSLProtocols you allow, the ciphers you permit, the openssl version your httpd version is compiled against, etc. – ezra-s Aug 30 '17 at 17:11
  • I didn't change de letsencrypt options-ssl-apache.conf default file (which use to work before). SSLProtocol : all -SSLv2 -SSLv3, OpenSSL 1.1.0f. Almost everything is the latest version for debian 9. – Hugo Trentesaux Aug 30 '17 at 19:21
  • 1
    A simple way to investigate the generated certificate is openssl x509 -in /etc/letsencrypt/live/mydomain.fr/fullchain.pem -noout -text – anx Aug 31 '17 at 4:54
  • Make sure SSLEngine on is set either in your VirtualHost block or the letsencrypt/options it includes. – dave_thompson_085 Aug 31 '17 at 19:44
  • It happens that changing <VirtualHost mydomain.fr:80> to <VirtualHost *:80> solved the problem. But it is not reproducible... – Hugo Trentesaux Feb 5 '18 at 14:27

Try to change your virtualhost to

<VirtualHost _default_:443>
        ServerName mydomain.fr
        DocumentRoot /var/www/html

The default tag, or * might work for unknown reason.

  • op's problem ssems related to port 443, not to port 80 – bgtvfr May 23 '18 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.