1

I'm trying to get web server software running on some ARM boxes that we have. I was able to get NGINX working exactly as expected when using HTTP, but when I try to switch the configuration to use HTTPS, connections time out.

The ARM boxes are using Linux 2.6 (I know...) and do not have very much memory, so it's entirely possible that using SSL isn't feasible if there are resource requirements.

Here is the relevant portion of /etc/nginx/sites-available/mysite (which is symlinked to sites-enabled/mysite):

server {
    #listen *:443 ssl default_server;
    listen *:80 default_server;

    server_name <box IP address>;

    root /var/www/myserver;

    proxy_buffering off;

    #ssl on;

    #ssl_session_cache shared:SSL:10m;

    #ssl_protocols TLSv1.2;
    #ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    #ssl_prefer_server_ciphers on;

    #ssl_certificate /etc/nginx/ssl/myserver.crt;
    #ssl_certificate_key /etc/nginx/ssl/myserver.key;

    location /htdocs {
            autoindex on;
            try_files $uri $uri/ =404;
    }
}

And /etc/nginx/nginx.conf mostly has the defaults:

user  www-data;
worker_processes  auto;

error_log  /var/log/nginx/error.log debug;

pid        /run/nginx/nginx.pid;

events {
    worker_connections  64;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    include /etc/nginx/sites-enabled/*;
}

When the above configuration is used, I am able to access the box at its IP address, and it correctly serves documents in /var/www/myserver/htdocs/. However, when I un-comment every commented line in sites-available/mysite and comment out the listen *:80 default_server line, all HTTPS connection attempts time out. The error and access logs have no entries for the timed-out connections. I am using a self-signed certificate for now, but I don't think that's making any difference. Requests with wget and curl from another host also time out.

There is not an active firewall, so port 443 is not being blocked. I can see NGINX binding to port 443 on the ARM box. I can also see that the connection attempt from my computer to port 443 on the box is ESTABLISHED, in netstat.

I'm using NGINX 1.12.2 built from source. These are the configure arguments:

--prefix=/usr --conf-path=/etc/nginx/nginx.conf --pid-path=/run/nginx/nginx.pid --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --with-pcre=../pcre-8.41 --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-stream --user=www-data --group=www-data --with-http_v2_module

The ARM box has OpenSSL 1.0.2l installed, which I also built from source.

Is there an obvious culprit causing NGINX to time out on SSL connections? If it is not obvious, what are some steps I can take to debug the connections?

Update:

When I run NGINX manually (after adding daemon off; to the config), I get some strange behavior that might be a hint. These are the steps I'm following:

  1. start NGINX on the ARM box (sudo nginx)
  2. use Curl on another machine to attempt a request (curl -v -k https://<box IP>/htdocs/css/main.css)
  3. press Ctrl+C on the ARM box to kill NGINX

At step 2, curl waits for the response, but nothing happens. Then, at step 3, curl outputs the requested file. It's as if Nginx's response is being buffered, and that buffer isn't being flushed until the NGINX process ends. This also shows that NGINX is completing the SSL handshake, but it's just not sending the response.

  • #listen *:443 ssl default_server; This section is commented, which means it will never be read into nginx. Remove the "#" on all rows please – Orphans Dec 17 '17 at 16:58
  • Please read the paragraph following the configuration files. The given configuration yields a HTTP server that works as expected, but un-commenting the commented lines (and commenting-out listen *:80 default_server;) does not yield a working HTTPS server. – millinon Dec 17 '17 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.