1

I'm running Apache 2.4.25 on a Raspian (Raspberry Pi) server.

I wanted to set up SSL certificates for the server, so I ran the following commands to get certbot:

sudo apt-get update
sudo apt-get install python-certbot-apache

Then I ran certbot like this:

sudo certbot certonly --standalone -d marksfam.com -d www.marksfam.com

That told me it had put my certs into the folder /etc/letsencrypt/live/marksfam.com. I checked and verified that it had created the files fullchain.pem and privkey.pem in there, along with cert.pem, chain.pem, and a README. Possibly of note (but I don't think so) - I can only view this folder if I'm sudo - my normal account can't view it.

Anyways, I symlinked mods-available/ssl.load into apache's mods-enabled directory and sites-available/default-ssl.conf into sites-enabled.

Inside of default-ssl.conf I have this:

<IfModule mod_ssl.c>
     <VirtualHost marksfam.com:443>
         ServerName www.marksfam.com
         ServerAdmin webmaster@local
         DocumentRoot /var/www/html
         ErrorLog ${APACHE_LOG_DIR}/error.log
         SSLEngine on
         SSLCertificateFile    /etc/letsencrypt/live/marksfam.com/fullchain.pem
         SSLCertificateKeyFile /etc/letsencrypt/live/marksfam.com/privkey.pem
    </VirtualHost>
</IfModule>

Then I restart the server with sudo service apache2 restart.

Accessing http://marksfam.com works fine. Accessing https://marksfam.com does not. In Firefox, I get the message:

An error occurred during a connection to www.marksfam.com. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

In Chrome, I get this message:

This site can’t provide a secure connection www.marksfam.com sent an invalid response. Try running Windows Network Diagnostics. ERR_SSL_PROTOCOL_ERROR

Neither Chrome nor Firefox tell me anything at all under their console tabs in their inspectors... no message tipping me off more about what I'm doing wrong.

If I check apache's error.log file, all I see is:

[mpm_event:notice] AH00491: caught SIGTERM, shutting down
[ssl:warn] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[mpm_event:notice] AH00489: Apache/2.4.25 (Raspian) OpenSSL/1.0.21 mod_wsgi/4.5.11 Python/2.7 confiured -- resuming normal operations
[core:notice] AH00094: Command line: '/usr/sbin/apache2'

Any idea what I've done wrong? Nothing seems to be giving useful error messages. Ports 80 and 443 both forward to the server which is up and running if you'd like to try accessing them yourself at marksfam.com . I get the same error messages whether I try going to https://marksfam.com or https://www.marksfam.com or https://192.168.0.2 (its local address, when I'm on the same local network as it.)

I'm happy to share more logs or configuration details if I've not shared enough already.

2

Something in your server is not properly configured and I think that this is not in the partial server configuration you've shown. Trying to reach your server shows that it is accepting plain HTTP requests on port 443, i.e. the port where it should expect only TLS traffic. Therefore I think that you have some other VirtualHost or some default configuration on port 443 which has not SSL enabled or no certificates configured. But you cannot mix plain HTTP and HTTPS on the same IP and port.

See also Debian server SSL certificate configuration returns err_ssl_protocol_error for a probably similar problem.

  • Wow - you’re right. Navigating to marksfam.com:443 (with an http:// instead of https://) actually loads something. I can’t believe I didn’t catch that myself. This gives me something to start looking into - thanks! – ArtOfWarfare Jun 8 '18 at 10:23
  • Changing the VirtualHost from marksfam.com:443 to *:443 fixed the issue. – ArtOfWarfare Jun 9 '18 at 2:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.