0

I Have insatlled ssl on my aws but not able to load my site on https https://darkcloud.app (My site) Certificate load balancer Route 53

ubuntu@ip-172-31-8-134:~$ curl -v https://www.darkcloud.app
Rebuilt URL to: https://www.darkcloud.app/
  Trying 54.153.123.21...
Connected to www.darkcloud.app (54.153.123.21) port 443 (#0)
found 148 certificates in /etc/ssl/certs/ca-certificates.crt
found 594 certificates in /etc/ssl/certs
ALPN, offering http/1.1
gnutls_handshake() failed: An unexpected TLS packet was received.
Closing connection 0
curl: (35) gnutls_handshake() failed: An unexpected TLS packet was received.
  • Can you post the Apache configs you're using? Also, mention Apache 2.4.18 and Ubuntu server (which I gathered from looking at the response headers). And mention the URL is "www.darkcloud.app" if it really is, which it seems to be. Plus... put the output of curl -v https://www.darkcloud.app in your question – varlogtim Aug 9 '18 at 18:11
  • Edited question – Anand Chandwani Aug 9 '18 at 18:21
  • 1
    We need your Apache config file. Basically, it looks like you haven't configured Apache for SSL, even though it is listening on port 443 – varlogtim Aug 9 '18 at 18:23
  • Here it is 54.153.123.21/apache2.conf – Anand Chandwani Aug 9 '18 at 18:34
  • So, what is in /etc/apache2/conf-enabled and /etc/apache2/sites-enabled - those two directories should have configs in them for your site. Also, possibly, /etc/apache2/mods-enabled - I think it would be easier for you to just google Configure SSL on Apache tutorial – varlogtim Aug 9 '18 at 18:38
1

There seems to be multiple issues:

  1. You are accessing the site with darkcloud.app but it doesn't have a DNS entry, create a similar DNS entry as www.darkcloud.app in route53
  2. Accessing site on port 443 i.e. https gives "unknown protocol" error that shows that load balancer is not configured properly for https, see curl output below:

    $ curl -I https://www.darkcloud.app curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

Accessing port 443 over http (not https) gives 200, can you check forwarding rules of ALB and see if the protocol is htttps?

$ curl -I http://www.darkcloud.app
HTTP/1.0 200 OK
Date: Thu, 09 Aug 2018 17:58:22 GMT
Server: Apache/2.4.18 (Ubuntu)
Cache-Control: no-cache, private
Connection: close
Content-Type: text/html; charset=UTF-8
  • If "www.darkcloud.app" is the URL, then openssl s_client -connect www.darkcloud.app:443 shows the following: CONNECTED(00000003) 139674356164248:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: ... basically, no SSL stuff is happening... – varlogtim Aug 9 '18 at 18:06
  • what should i do now ? – Anand Chandwani Aug 9 '18 at 18:09
1

You have correctly configured your Authoritative Name Servers to point to AWS. However, you have not configured any A records for your domain.

Check out the docs: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html

Here is how I determined this:

Querying Googles DNS to see what NS records are configured for that domain:

 ttucker@dib:~$ dig ns darkcloud.app @8.8.8.8

 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns darkcloud.app @8.8.8.8
 ;; global options: +cmd
 ;; Got answer:
 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11295
 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

 ;; OPT PSEUDOSECTION:
 ; EDNS: version: 0, flags:; udp: 512
 ;; QUESTION SECTION:
 ;darkcloud.app.                    IN      NS

 ;; ANSWER SECTION:
 darkcloud.app.             21592   IN      NS      ns-1351.awsdns-40.org.
 darkcloud.app.             21592   IN      NS      ns-1770.awsdns-29.co.uk.
 darkcloud.app.             21592   IN      NS      ns-442.awsdns-55.com.
 darkcloud.app.             21592   IN      NS      ns-532.awsdns-02.net.

 ;; Query time: 7 msec
 ;; SERVER: 8.8.8.8#53(8.8.8.8)
 ;; WHEN: Thu Aug 09 17:50:50 UTC 2018
 ;; MSG SIZE  rcvd: 182

Then when I query each of the NS servers they indicate that there are no A records specified for your domain:

First:

ttucker@dib:~$ dig darkcloud.app @ns-1351.awsdns-40.org

; <<>> DiG 9.10.3-P4-Ubuntu <<>> darkcloud.app @ns-1351.awsdns-40.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34844
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;darkcloud.app.                     IN      A

;; AUTHORITY SECTION:
darkcloud.app.              900     IN      SOA     ns-1351.awsdns-40.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 6 msec
;; SERVER: 205.251.197.71#53(205.251.197.71)
;; WHEN: Thu Aug 09 17:52:37 UTC 2018
;; MSG SIZE  rcvd: 127

Second:

ttucker@dib:~$ dig darkcloud.app @ns-1770.awsdns-29.co.uk 

; <<>> DiG 9.10.3-P4-Ubuntu <<>> darkcloud.app @ns-1770.awsdns-29.co.uk
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38995
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;darkcloud.app.                     IN      A

;; AUTHORITY SECTION:
darkcloud.app.              900     IN      SOA     ns-1351.awsdns-40.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 19 msec
;; SERVER: 205.251.198.234#53(205.251.198.234)
;; WHEN: Thu Aug 09 17:53:09 UTC 2018
;; MSG SIZE  rcvd: 127

Third:

ttucker@dib:~$ dig darkcloud.app @ns-442.awsdns-55.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> darkcloud.app @ns-442.awsdns-55.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17064
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;darkcloud.app.                     IN      A

;; AUTHORITY SECTION:
darkcloud.app.              900     IN      SOA     ns-1351.awsdns-40.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 6 msec
;; SERVER: 205.251.193.186#53(205.251.193.186)
;; WHEN: Thu Aug 09 17:53:50 UTC 2018
;; MSG SIZE  rcvd: 127

Fourth:

ttucker@dib:~$ dig darkcloud.app @ns-532.awsdns-02.net

; <<>> DiG 9.10.3-P4-Ubuntu <<>> darkcloud.app @ns-532.awsdns-02.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49245
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;darkcloud.app.                     IN      A

;; AUTHORITY SECTION:
darkcloud.app.              900     IN      SOA     ns-1351.awsdns-40.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 7 msec
;; SERVER: 205.251.194.20#53(205.251.194.20)
;; WHEN: Thu Aug 09 17:54:30 UTC 2018
;; MSG SIZE  rcvd: 127

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.