1

I purchased COMODO Positive SSL Wildcard two days ago and have been working really hard to make it works with my Nginx. But I don't know why it doesn't work. Here is what I do.

1. Creating a private key in my server

I created my example_com.csr and example_com.key file on my server by this command

openssl req -new -newkey rsa:2048 -nodes -keyout example_com.key -out example_com.csr

These files are store in /etc/ssl

2. Sending my example_com.csr to COMODO

After I sent my csr file and verified my domain name, I got 3 files back like so:

ssl_1540054330.ca-bundle
ssl_1540054330.crt
ssl_1540054330.key

I put ssl_1540054330.crt and ssl_1540054330.ca-bundle contents together for a full file called ssl_1540054330-bundle-full.crt

3. Adding to Nginx

I uploaded ssl_1540054330-bundle-full.crt to /etc/ssl` and add to Nginx by this config

server 
{
    listen 80;
    listen 443 ssl;
    server_name  subdomain.example.com;

    # SSL
    ssl_certificate /etc/ssl/ssl_1540054330-bundle-full.crt;
    ssl_certificate_key /etc/ssl/example_com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'EECDH+AES128:EECDH+AES256:+SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RSA+3DES:!DSS';

After that, I check Nginx config by run nginx -t and output is

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

And systemctl restart nginx command working fine. I also disabled firewalld to make sure that my 443 port working as well

Unfortunately, it doesn't work, Chrome says "This site can’t be reached", I test with openssl on my server by this command

openssl s_client -connect subdomain.example.com:443

And output is

CONNECTED(00000003)
140363396503456:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 289 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1540084821
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

I have been googling in two days and tried to fix this but can't found any solutions so I ask here hope someone can help.

Here is my server information in detail

Nginx Information

root@vnf ~]# nginx -V
nginx version: nginx/1.14.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'

My OpenSSL information

[root@vnf ~]# openssl version
OpenSSL 1.0.2k-fips  26 Jan 2017

My OS version

[root@vnf ~]# cat /etc/centos-release
CentOS Linux release 7.4.1708 (Core) 

Any idea?

  • Please update your system's packages, (e.g. yum upgrade) and then try again. After that, check the nginx error log. – Michael Hampton Oct 20 '18 at 18:02
  • @MichaelHampton I have done this, not working. Log doesn't tell anything even I enabled debug mode – vietnguyen09 Oct 20 '18 at 18:23
  • Have you tried commenting out the ssl_ciphers option temporarily? – garethTheRed Oct 20 '18 at 20:12
  • @garethTheRed Yes I tried but no luck – vietnguyen09 Oct 21 '18 at 5:46

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.