CODEWITHSUNDEEP
sslnginx
Owen
Owen

Reputation: 7098

SSL Termination on NGINX

I have purchased an SSL cert and bundled it up correctly in so much as when I verify the modulus (i.e. https://kb.wisc.edu/middleware/4064) then the hashes are the same.

I have moved the cert and key to my server @ /etc/ssl and ensured that the folder permissions are 700 and each file is 600.

I have then the following nginx config:

server {
    listen   80;
    listen   443 ;
    server_name escapehatch.chrisjowen.uk;
    ssl    on;
    ssl_certificate    /etc/ssl/ssl-bundle.crt;
    ssl_certificate_key /etc/ssl/secret.txt;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;

    location / {
        proxy_pass http://localhost:8080;
    }
}

Finally, to test this, I have a Python SimpleHTTPServer running on port 8080. When I hit the URL on HTTPS, I receive an error

This site can’t provide a secure connection

Looking at the logs from the Python server, I see:

218.186.183.142 - - [21/Aug/2019 04:45:53] code 400, message Bad HTTP/0.9 request type ('\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03\x01a\x96\x061LE\x88I\xf1i\x7f\xc3\xdc%d\x18r\xbbzq9q<\xeb\x1dD\xa3\x8b\x01\x10\x7f')
218.186.183.142 - - [21/Aug/2019 04:45:53] "�a�1LE�I�i��%dr�zq9q<�D�� n��Z���΀��SN�F���j;X.Zw�s^�"**�+�/�,�0̨̩����/5" 400 -
218.186.183.142 - - [21/Aug/2019 04:45:53] code 400, message Bad request version ('\x0fb\x03g\x8d\x04\x8b\xbe!\xad\x98W\x9bV\xd2\x8e\x1e\xc6\xf3\xaa\xff\xce\x0f\x1b\xc9\x0f\xebY\xae\xc4\x00"\xfa\xfa\x13\x01\x13\x02\x13\x03\xc0+\xc0/\xc0,\xc00\xcc\xa9\xcc\xa8\xc0\x13\xc0\x14\x00\x9c\x00\x9d\x00/\x005\x00')

So, it seems like nginx is not decrypting the request and terminating the SSL connection, instead it's passing it to the upstream server, which I do not want.

Checking the nginx logs /var/log/nginx/nginx.vhost.access.log shows nothing.

So, now I am stumped what to do to debug the issue, it appears that either nginx config is wrong or there is something wrong with the cert, but as mentioned I checked this with the following method https://kb.wisc.edu/middleware/4064

Upvotes: 0

Views: 4576

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123521

listen   80;
listen   443 ;

If you want it to listen for plain http on port 80 and https on port 443 the second line should be listen 443 ssl;.

ssl    on;

From the documentation:

This directive was made obsolete in version 1.15.0. The ssl parameter of the listen directive should be used instead.

Also you have the following in the logs of your Python server:

218.186.183.142 - - [21/Aug/2019 04:45:53] code 400, ....

This Python server is clearly visited directly by an external IP address. If the request would be forwarded by the local nginx then the source IP should be 127.0.0.1 instead. This shows, that you don't hit nginx at all but somehow make a direct request to the Python server.

Upvotes: 1

Related Questions