Nginx – Error code: ssl_error_rx_record_too_long on nginx ubuntu server

djangohttpsnginxsslUbuntu

I have a site which was perfectly running with apache on some old ubuntu server and also has https for it. But now for some reasons i need to move to different(new ubuntu server with high configuration) server and trying to serve my site using Nginx, and so installed nginx (nginx/1.4.6 (Ubuntu)). Below is my nginx.conf file settings

server {
  listen 8005;

  location / {
    proxy_pass http://127.0.0.1:8001;
  }

  location /static/ {
    alias /root/apps/project/static/;
  }

  location /media/ {
    alias  /root/apps/media/;
  }

}

# Https Server
server {
      listen 443;
      location / {
#            proxy_set_header Host $host;
#            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#            proxy_set_header X-Forwarded-Protocol $scheme;
#            proxy_set_header X-Url-Scheme $scheme;
#            proxy_redirect off;
            proxy_pass http://127.0.0.1:8001;
         }
      server_tokens off;

      ssl                  on;
      ssl_certificate      /etc/ssl/certificates/project.com.crt;
      ssl_certificate_key  /etc/ssl/certificates/www.project.com.key;
      ssl_session_timeout  20m;
      ssl_session_cache    shared:SSL:10m;  # ~ 40,000 sessions
      ssl_protocols        SSLv3 TLSv1; # SSLv2
      ssl_ciphers          ALL:!aNull:!eNull:!SSLv2:!kEDH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+EXP:@STRENGTH;
      ssl_prefer_server_ciphers on;


}

Since i was already having https certificate(project.com.crt) and key(www.project.com.key) running on another server, i had just copied them to new server(which does not contain any domain as of now, and has only IP) and placed in at path /etc/ssl/certificates/ and trying to use them directly. Now i had restarted Nginx and tried to access my IP 23.xxx.xxx.xx:8005 with https:// 23.xxx.xxx.xx:8005 and i am getting the below error in firefox

Secure Connection Failed

An error occurred during a connection to 23.xxx.xxx.xx:8005. SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long)

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

But when i access the IP without https, i can able to serve my site.

So whats wrong with my Https settings in the above nginx conf file ?
Whether we can't serve the certificate files by simply copying and pasting at some folder ? do we need to create any extra certificate for my new server ?

Edit

After making some changes according to below answer, now i am getting the below error

This is probably not the site you are looking for!

You attempted to reach 23.xxx.xxx.xx, but instead you actually reached a server identifying itself as www.xxxxxxxx.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of 23.xxx.xxx.xx.

So actually the certificate was working fine in old server and was trusted, but the same certificate was complaining that it was not trusted one, so this error will not appear once we make the DNS changes ? i mean once we redirect my site www.xxxxxxxx.com to new ip 23.xxx.xxx.xx ?

Best Answer

You have configured SSL to the port 443.

If you want to have SSL in port 8005, and nothing on 443 port, use this configuration:

server {
    listen 8005 ssl;

    ssl_certificate      /etc/ssl/certificates/project.com.crt;
    ssl_certificate_key  /etc/ssl/certificates/www.project.com.key;
    ssl_session_timeout  20m;
    ssl_session_cache    shared:SSL:10m;  # ~ 40,000 sessions
    ssl_protocols        SSLv3 TLSv1; # SSLv2
    ssl_ciphers          ALL:!aNull:!eNull:!SSLv2:!kEDH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+EXP:@STRENGTH;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://127.0.0.1:8001;
    }

    location /static/ {
        alias /root/apps/project/static/;
    }

    location /media/ {
        alias  /root/apps/media/;
    }
}

Then a couple of points about the configuration..

  • You should not use /root for storing any files for the web. It might cause problems in the long run. Use something under /var/www.
  • You should use a more secure version of the ciphers for the clients, for example ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; recommended by Qualys.
Related Topic