1

Today I issued and installed SSL certificates for my website. This is the rating assigned by https://www.ssllabs.com/ssltest/analyze.html : enter image description here This is the result of https://check-your-website.server-daten.de/ which indicates "only" content problems: mixed, content, missing files, but nothing related to SSL_PROTOCOL enter image description here

When I connect to the local IP address, everything goes smoothly with no errors: - after stopping nginx server: enter image description here

and - also after restarting nginx server:

   (base) marco@pc01:~$ sudo systemctl start nginx
  (base) marco@pc01:~$ sudo systemctl reload nginx
  (base) marco@pc01:~$ sudo systemctl status nginx
    ● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: en
  Active: active (running) since Tue 2020-02-11 19:06:58 CET; 10s ago
     Docs: man:nginx(8)
  Process: 6124 ExecStop=/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 -
  Process: 8843 ExecReload=/usr/sbin/nginx -g daemon on; master_process on; -s r
  Process: 8779 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code
  Process: 8770 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process 
 Main PID: 8784 (nginx)
    Tasks: 9 (limit: 4915)
   CGroup: /system.slice/nginx.service
                 ├─8784 nginx: master process /usr/sbin/nginx -g daemon on; master_pro
                 ├─8844 nginx: worker process
                 ├─8846 nginx: worker process
                 ├─8847 nginx: worker process
                 ├─8849 nginx: worker process
                 ├─8850 nginx: worker process
                 ├─8851 nginx: worker process
                 ├─8852 nginx: worker process
                 └─8853 nginx: worker process

 the output is fine:  
       [![enter image description here][4]][4]

But when I connect to my website's through website name I get net::ERR_SSL_PROTOCOL_ERROR : enter image description here

This is my /etc/nginx/nginx.conf :

user www-data;
worker_processes auto;
pid /run/nginx.pid;
#include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        #ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;
        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss
           text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        #include /etc/nginx/sites-enabled/*;
}

And this is my /etc/nginx/conf.d/default.conf :

server {
    listen 443 ssl http2 default_server;
    server_name ggc.world;

    ssl_certificate /etc/letsencrypt/live/ggc.world/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/ggc.world/privkey.pem; # managed by Certbot

    ssl_trusted_certificate /etc/letsencrypt/live/ggc.world/chain.pem;

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    ssl_session_timeout 5m;
    #ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-
      draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_stapling on;
    ssl_stapling_verify on;

    access_log /var/log/nginx/ggcworld-access.log combined;

    add_header Strict-Transport-Security "max-age=31536000";
    location = /favicon.ico { access_log off; log_not_found off; }

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    error_page 497 https://$host:$server_port$request_uri;
    server_name www.ggc.world;
    return 301 https://$server_name$request_uri;

    access_log /var/log/nginx/ggcworld-access.log combined;

    add_header Strict-Transport-Security "max-age=31536000";
    location = /favicon.ico { access_log off; log_not_found off; }

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

upstream websocket {
    ip_hash;
    server localhost:3000;
}

server {
    listen 81;
    server_name ggc.world www.ggc.world;

    #location / {
    location ~ ^/(websocket|websocket\/socket-io) {
        proxy_pass http://127.0.0.1:4201;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwared-For $remote_addr;
        proxy_set_header Host $host;

        proxy_redirect off;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

As suggested here: Chrome ERR_SSL_PROTOCOL_ERROR on known working site I cleared host cache: enter image description here

and also flushed socket pools: enter image description here

But after clearing the browsing data, the problem persists.

nginx -v : nginx version: nginx/1.14.0 (Ubuntu)

OS: Ubuntu 18.04.4 Desktop

This is the process I followed to obtain the certificate:

I followed these well done indications: https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc115915de8

(base) marco@pc01:~$ sudo nano /etc/nginx/sites-available
/ggc.world.conf


server {
        listen 80;
        listen [::]:80;

        server_name ggc.world www.ggc.world;
        root /var/www/ggc.world;

        index index.html;
        location / {
                try_files $uri $uri/ =404;
        }
}


(base) marco@pc01:~$ sudo rm /etc/nginx/sites-enabled/default 
(base) marco@pc01:~$ sudo ln -s /etc/nginx/sites-available
/ggc.world.conf /etc/nginx/sites-enabled/ggc.world.conf
(base) marco@pc01:~$ sudo systemctl reload nginx
(base) marco@pc01:~$ sudo systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy 
server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor 
preset: enabled)
   Active: active (running) since Tue 2020-02-11 11:16:22 CET; 1h 3min
 ago
     Docs: man:nginx(8)
  Process: 19025 ExecReload=/usr/sbin/nginx -g daemon on; 
master_process on; -s reload (code=exited, status=0/SUCCESS)
 Main PID: 4461 (nginx)
    Tasks: 9 (limit: 4915)
   CGroup: /system.slice/nginx.service
           ├─ 4461 nginx: master process /usr/sbin/nginx -g daemon on;
                          master_process on;
           ├─19026 nginx: worker process
           ├─19027 nginx: worker process
           ├─19028 nginx: worker process
           ├─19029 nginx: worker process
           ├─19030 nginx: worker process
           ├─19031 nginx: worker process
           ├─19032 nginx: worker process
           └─19033 nginx: worker process

feb 11 11:16:22 pc01 systemd[1]: Starting A high performance web 
server and a reverse proxy server...
feb 11 11:16:22 pc01 systemd[1]: Started A high performance web server
 and a reverse proxy server.
feb 11 11:59:29 pc01 systemd[1]: Reloading A high performance web 
server and a reverse proxy server.
feb 11 11:59:29 pc01 systemd[1]: Reloaded A high performance web 
server and a reverse proxy server.
feb 11 12:19:28 pc01 systemd[1]: Reloading A high performance web 
server and a reverse proxy server.
feb 11 12:19:28 pc01 systemd[1]: Reloaded A high performance web 
server and a reverse proxy server.
(base) marco@pc01:~$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful


(base) marco@pc01:~$ sudo apt-get update
Ign:1 http://dl.google.com/linux/chrome/deb stable InRelease
Hit:2 http://it.archive.ubuntu.com/ubuntu bionic InRelease                                  
Get:3 http://security.ubuntu.com/ubuntu bionic-security InRelease 
[88,7 kB]                                                
Get:4 http://it.archive.ubuntu.com/ubuntu bionic-updates InRelease 
[88,7 kB]                                               
Hit:5 http://dl.google.com/linux/chrome/deb stable Release                                                           
Get:6 http://it.archive.ubuntu.com/ubuntu bionic-backports InRelease 
[74,6 kB]                                       
Get:8 http://it.archive.ubuntu.com/ubuntu bionic-updates/main amd64 
Packages [851 kB]
Get:9 http://security.ubuntu.com/ubuntu bionic-security/main amd64 
DEP-11 Metadata [38,6 kB]
Get:10 http://security.ubuntu.com/ubuntu bionic-security/main DEP-11 
48x48 Icons [17,6 kB]                       
Get:11 http://security.ubuntu.com/ubuntu bionic-security/main DEP-11 
64x64 Icons [41,5 kB]       
Get:12 http://security.ubuntu.com/ubuntu bionic-security/universe 
amd64 DEP-11 Metadata [42,1 kB]                          
Get:13 http://security.ubuntu.com/ubuntu bionic-security/universe 
DEP-11 64x64 Icons [111 kB]       
Get:14 http://security.ubuntu.com/ubuntu bionic-security/multiverse 
amd64 DEP-11 Metadata [2.464 B]
Get:15 http://it.archive.ubuntu.com/ubuntu bionic-updates/main amd64 
DEP-11 Metadata [294 kB]
Get:16 http://it.archive.ubuntu.com/ubuntu bionic-updates/main DEP-11 
48x48 Icons [73,8 kB]
Get:17 http://it.archive.ubuntu.com/ubuntu bionic-updates/main DEP-11 
 64x64 Icons [140 kB]
Get:18 http://it.archive.ubuntu.com/ubuntu bionic-updates/universe 
amd64 DEP-11 Metadata [264 kB]
Get:19 http://it.archive.ubuntu.com/ubuntu bionic-updates/universe 
DEP-11 48x48 Icons [203 kB]
Get:20 http://it.archive.ubuntu.com/ubuntu bionic-updates/universe 
DEP-11 64x64 Icons [464 kB]
Get:21 http://it.archive.ubuntu.com/ubuntu bionic-updates/multiverse 
amd64 DEP-11 Metadata [2.468 B]  
Get:22 http://it.archive.ubuntu.com/ubuntu bionic-backports/universe 
amd64 DEP-11 Metadata [8.280 B]
Fetched 2.807 kB in 1s (3.005 kB/s)                                      
Reading package lists... Done

(base) marco@pc01:~$ sudo apt-get install software-properties-common
Reading package lists... Done
Building dependency tree       
Reading state information... Done
software-properties-common is already the newest version 
(0.96.24.32.12).
software-properties-common set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
(base) marco@pc01:~$ sudo add-apt-repository universe
'universe' distribution component is already enabled for all sources.

(base) marco@pc01:~$ sudo add-apt-repository ppa:certbot/certbot
 This is the PPA for packages prepared by Debian Let's Encrypt Team 
and backported for Ubuntu.

Note: Packages are only provided for currently supported Ubuntu 
releases.
 More info: https://launchpad.net/~certbot/+archive/ubuntu/certbot
Press [ENTER] to continue or Ctrl-c to cancel adding it.

Hit:1 http://it.archive.ubuntu.com/ubuntu bionic InRelease
Hit:2 http://it.archive.ubuntu.com/ubuntu bionic-updates InRelease                    
Hit:3 http://it.archive.ubuntu.com/ubuntu bionic-backports InRelease                              
Ign:4 http://dl.google.com/linux/chrome/deb stable InRelease                                                                           
Hit:5 http://security.ubuntu.com/ubuntu bionic-security InRelease                                                                      
Get:6 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic InRelease
[21,3 kB]                    
Hit:7 http://dl.google.com/linux/chrome/deb stable Release                                          
Get:9 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic/main 
amd64 Packages [8.032 B]
Get:10 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic/main
i386 Packages [8.028 B]
Get:11 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic/main  
Translation-en [4.176 B]
Fetched 41,5 kB in 1s (58,8 kB/s)                      
Reading package lists... Done

(base) marco@pc01:~$ sudo apt-get update
Hit:1 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic InRelease
Hit:2 http://it.archive.ubuntu.com/ubuntu bionic InRelease                                                                                          
Ign:3 http://dl.google.com/linux/chrome/deb stable InRelease                                                                                        
Hit:4 http://it.archive.ubuntu.com/ubuntu bionic-updates InRelease                                    
Hit:5 http://it.archive.ubuntu.com/ubuntu bionic-backports InRelease                                  
Hit:6 http://dl.google.com/linux/chrome/deb stable Release                                    
Hit:7 http://security.ubuntu.com/ubuntu bionic-security InRelease       
Reading package lists... Done



(base) marco@pc01:~$ sudo apt-get install certbot python-certbot-nginx
Reading package lists... Done
Building dependency tree       
Reading state information... Done
certbot is already the newest version  
(0.31.0-1+ubuntu18.04.1+certbot+1).
python-certbot-nginx is already the newest version     
(0.31.0-1+ubuntu18.04.1+certbot+1).
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

(base) marco@pc01:~$ sudo certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Enter email address (used for urgent renewal and security notices)   
(Enter 'c' to cancel): 


Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You
must agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory

(A)gree/(C)ancel: A


Would you be willing to share your email address with the Electronic  
Frontier Foundation, a founding partner of the Let's Encrypt project 
and the non-profit organization that develops Certbot? We'd like to 
send you email about our work encrypting the web, EFF news, campaigns,
and ways to support digital freedom.
(Y)es/(N)o: N

Which names would you like to activate HTTPS for?
1: ggc.world
2: www.ggc.world

Select the appropriate numbers separated by commas and/or spaces, or 
leave input blank to select all options shown (Enter 'c' to cancel): 
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for ggc.world
http-01 challenge for www.ggc.world
Waiting for verification...
Cleaning up challenges
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled
/ggc.world.conf
Deploying Certificate to VirtualHost /etc/nginx/sites-enabled
/ggc.world.conf

Please choose whether or not to redirect HTTP traffic to HTTPS,     
removing HTTP access.
1: No redirect - Make no further changes to the webserver 
   configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. 
  Choose this for new sites, or if you're confident your site works on 
  HTTPS. 
  You can undo this hange by editing your web server's configuration.
Select the appropriate number [1-2] then [enter] (press 'c' to 
cancel): 2
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled
/ggc.world.conf
Redirecting all traffic on port 80 to ssl in /etc/nginx/sites-enabled
/ggc.world.conf

Congratulations! You have successfully enabled https://ggc.world and
https://www.ggc.world

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=ggc.world
https://www.ssllabs.com/ssltest/analyze.html?d=www.ggc.world


IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/ggc.world/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/ggc.world/privkey.pem
   Your cert will expire on 2020-05-11. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

Following the indications here: https://gist.github.com/cecilemuller/a26737699a7e70a7093d4dc115915de8 I then modified /etc/nginx/sites-available/ggc.world.conf and /etc/letsencrypt/options-ssl-nginx.conf for a tighter security:

(base) marco@pc01:~$ sudo nano /etc/nginx/sites-available
/ggc.world.conf

    server {

            server_name ggc.world www.ggc.world;
            root /var/www/ggc.world;

            index index.html;
            location / {
                    try_files $uri $uri/ =404;
            }

            #listen [::]:443 ssl ipv6only=on; # managed by Certbot
            #listen 443 ssl; # managed by Certbot

            listen [::]:443 ssl http2 ipv6only=on;
            listen 443 ssl http2;
            gzip off;

            ssl_certificate /etc/letsencrypt/live/ggc.world
            /fullchain.pem; # managed by Certbot
            ssl_certificate_key /etc/letsencrypt/live/ggc.world
            /privkey.pem; # managed by Certbot

            ssl_trusted_certificate /etc/letsencrypt/live/ggc.world
            /chain.pem;

            include /etc/letsencrypt/options-ssl-nginx.conf; # managed
             by Certbot
            ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed 
            by Certbot

    }

    server {
        if ($host = www.ggc.world) {
            return 301 https://$host$request_uri;
        } # managed by Certbot


        if ($host = ggc.world) {
            return 301 https://$host$request_uri;
        } # managed by Certbot


            listen 80;
            listen [::]:80;

            server_name ggc.world www.ggc.world;
        return 404; # managed by Certbot

}





(base) marco@pc01:~$ sudo nano /etc/letsencrypt/options-ssl-nginx.conf 



    # This file contains important security parameters. If you modify 
this file
    # manually, Certbot will be unable to automatically provide future
 security
    # updates. Instead, Certbot will print and log an error message
 with a path to
   # the up-to-date file that you will need to refer to when manually
 updating
    # this file.

    ssl_session_cache shared:le_nginx_SSL:1m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;

    ssl_stapling on;
    ssl_stapling_verify on;

    add_header Strict-Transport-Security "max-age=15768000;   
    includeSubdomains; preload;";
    add_header Content-Security-Policy "default-src 'none'; frame-
    ancestors 'none'; script-src 'self'; img-src 'self'; style-src 
    'self'; base-uri 'self'; form-action 'self';";
    add_header Referrer-Policy "no-referrer, strict-origin-when-cross-
    origin";
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

I then reloaded and restarted nginx server:

(base) marco@pc01:~$ sudo systemctl reload nginx
(base) marco@pc01:~$ sudo systemctl start nginx
(base) marco@pc01:~$ sudo systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy 
  server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor 
   preset: enabled)
   Active: active (running) since Tue 2020-02-11 11:16:22 CET; 1h 
  30min ago
     Docs: man:nginx(8)
  Process: 23810 ExecReload=/usr/sbin/nginx -g daemon on;   
  master_process on; -s reload (code=exited, status=0/SUCCESS)
 Main PID: 4461 (nginx)
    Tasks: 9 (limit: 4915)
   CGroup: /system.slice/nginx.service
           ├─ 4461 nginx: master process /usr/sbin/nginx -g daemon on; 
  master_process on;
           ├─23813 nginx: worker process
           ├─23815 nginx: worker process
           ├─23816 nginx: worker process
           ├─23817 nginx: worker process
           ├─23818 nginx: worker process
           ├─23819 nginx: worker process
           ├─23820 nginx: worker process
           └─23821 nginx: worker process

feb 11 11:16:22 pc01 systemd[1]: Starting A high performance web 
server and a reverse proxy 
    server...
    feb 11 11:16:22 pc01 systemd[1]: Started A high performance web 
server and a reverse proxy server.
feb 11 11:59:29 pc01 systemd[1]: Reloading A high performance web 
server and a reverse proxy server.
feb 11 11:59:29 pc01 systemd[1]: Reloaded A high performance web 
server and a reverse proxy server.
feb 11 12:19:28 pc01 systemd[1]: Reloading A high performance web 
server and a reverse proxy server.
feb 11 12:19:28 pc01 systemd[1]: Reloaded A high performance web 
server and a reverse proxy server.
feb 11 12:46:16 pc01 systemd[1]: Reloading A high performance web 
server and a reverse proxy server.
feb 11 12:46:16 pc01 systemd[1]: Reloaded A high performance web 
server and a reverse proxy server.

(base) marco@pc01:~$ sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

What is going on? What might be the causes of this SSL_PROTOCOL error? How to solve it? What do I have to modify in /etc/nginx/conf.d/default.conf?

Looking forward to your kind help. Marco

5

1 Answer 1

0

Thanks to a resolutive contribution by a member of nginx forum, I solved the problem. I post here the solution, in case someone else needs it: https://forum.vuejs.org/t/vue-with-nginx/26843/3

nano vue.config.js :

// vue.config.js
module.exports = {
  // options...
  publicPath: '',
  devServer: {
    host: '0.0.0.0',
    port: 8080,
    public: 'ggc.world'
  },
}

enter image description here

I thank @Ramhound for his kind help

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .