Estou tentando estamblish https na porta 55434 (diferente do padrão 443). Minha configuração nginx se parece com isso:
server {
server_name example.org;
listen 55434 ssl;
ssl on;
ssl_certificate /etc/ssl/certs/example.org.crt;
ssl_certificate_key /etc/ssl/private/example.org.key;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
...
}
A porta 55434 está aberta
iptables -L
ACCEPT tcp -- anywhere anywhere tcp dpt:55434
A porta 55434 está escutando:
netstat -a | egrep 'Proto|LISTEN'
tcp 0 0 *:55434 *:* LISTEN
O certificado foi gerado pelo link . Quando visito o link , recebo a resposta seguinte.
wget https://example.org:55434
--2013-01-11 11:11:11-- https://example.org:55434/
Resolving example.org... 1.2.3.4
Connecting to example.org|1.2.3.4|:55434... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.
openssl s_client -showcerts -connect example.org:55434 resultados em
CONNECTED(00000003)
8528:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:607
wget --version
GNU Wget 1.12 built on linux-gnu.
+digest +ipv6 +nls +ntlm +opie +md5/openssl +https -gnutls +openssl
-iri
Wgetrc:
/etc/wgetrc (system)
Locale: /usr/share/locale
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
-DLOCALEDIR="/usr/share/locale" -I. -I../lib -g -O2
-D_FILE_OFFSET_BITS=64 -O2 -g -Wall
Link: gcc -g -O2 -D_FILE_OFFSET_BITS=64 -O2 -g -Wall /usr/lib/libssl.so
/usr/lib/libcrypto.so -ldl -lrt ftp-opie.o openssl.o http-ntlm.o
gen-md5.o ../lib/libgnu.a
nginx -V (eu mesmo compilei)
nginx version: nginx/1.2.6
built by gcc 4.4.5 (Debian 4.4.5-8)
TLS SNI support enabled
configure arguments:
--conf-path=/etc/nginx/nginx.conf
--add-module=../naxsi-core-0.49/naxsi_src/
--error-log-path=/var/log/nginx/error.log
--http-client-body-temp-path=/var/lib/nginx/body
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--http-log-path=/var/log/nginx/access.log
--http-proxy-temp-path=/var/lib/nginx/proxy
--lock-path=/var/lock/nginx.lock
--pid-path=/var/run/nginx.pid
--with-http_ssl_module
--without-mail_pop3_module
--without-mail_smtp_module
--without-mail_imap_module
--without-http_uwsgi_module
--without-http_scgi_module
--with-ipv6
--prefix=/usr
--with-http_realip_module
--2013-03-18 19:35:54-- https://example.org/
Resolving example.org... 1.2.3.4
Connecting to example.org|1.2.3.4|:443... connected.
OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Unable to establish SSL connection.
openssl s_client -connect example.org:443 -debug -state
CONNECTED(00000003)
SSL_connect:before/connect initialization
write to 0xf5d77a0 [0xf5d78b0] (121 bytes => 121 (0x79))
0000 - 80 77 01 03 01 00 4e 00-00 00 20 00 00 39 00 00 .w....N... ..9..
0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............
0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 05 00 ..3..2../.......
0030 - 00 04 01 00 80 00 00 15-00 00 12 00 00 09 06 00 ................
0040 - 40 00 00 14 00 00 11 00-00 08 00 00 06 04 00 80 @...............
0050 - 00 00 03 02 00 80 00 00-ff 8b 1a e3 12 30 7c ce .............0|.
0060 - fe 39 68 93 f1 52 d6 20-94 7c 41 4d aa e6 b0 9a .9h..R. .|AM....
0070 - b8 d3 1d 1e ab a3 53 60-5d ......S']
SSL_connect:SSLv2/v3 write client hello A
read from 0xf5d77a0 [0xf5dce10] (7 bytes => 7 (0x7))
0000 - 3c 68 74 6d 6c 3e 0d <html>.
SSL_connect:error in SSLv2/v3 read server hello A
30203:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:607:
no Google Chrome eu recebo o erro 107 (net :: ERR_SSL_PROTOCOL_ERROR)
Tags ssl openssl nginx https ssl-certificate