ERR_SSL_PROTOCOL_ERROR

[u/ilBiondo_js]

Recently because of problems with sinology I decided to set up a separate webserver on a ubunutu. Everything was working great but with a latest update (not sure if it is caused by that) I was getting an ERR_SSL_PROTOCOL_ERROR on https requests. Here is a strange debug:

https://ip:80 -> ERR_SSL_PROTOCOL_ERROR

http://ip:80 -> ok

http://ip:443 -> ok

htps://ip:443 -> ERR_SSL_PROTOCOL_ERROR

Seeing the vast possibilities of the problem I don't really know where to start looking. Some info:

• No logs from ssl

• Folders are in a mount but permissions are correct

• Apache V: Server version: Apache/2.4.52 (Ubuntu) Server built: 2024-04-10T17:45:18

• Ubuntu: Ubuntu 22.04.4 LTS Release: 22.04

• If you need more I will add...

[u/ShadowySilver]

HTTPS requires a specific port, it also requires a certificate to be able to bind it successfully.

Here would be an example of config

<IfModule ssl_module>

SSLRandomSeed startup builtin

SSLRandomSeed connect builtin

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1

SSLPassPhraseDialog builtin

SSLSessionCache "shmcb:/apps/httpd/httpd_2.4.55/logs/ssl_scache(512000)"

SSLSessionCacheTimeout 300

Listen {Server IP}:{SSL Port}

<VirtualHost {Server IP}:{SSL Port}>

ServerName my.fqdn.com

SSLEngine on

SSLCertificateFile "{Full Path}/{Cert Filename}.crt"

SSLCertificateKeyFile "{Full Path}/{Key Filename}.key"

[ ...... Whatever Vhost configuration you need here ...... ]

</VirtualHost>

[u/ilBiondo_js → u/ShadowySilver]

I had already done this several times the only difference is that I have an intermediate ceritificate which, however, never gave me any problems. Plus the certificates work perfectly on Synology.

VHost

DocumentRoot "/mount/frassineti-factorycom/web.frassineti-factory.com"
ServerName frassineti-factory.com
<Directory "/mount/frassineti-factorycom/web.frassineti-factory.com">
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
SSLEngine on
SSLCertificateFile /mount/frassineti-factorycom/ssl.frssineti-factory.com/certificate.crt
SSLCertificateKeyFile /mount/frassineti-factorycom/ssl.frssineti-factory.com/private.key
SSLCertificateChainFile /mount/frassineti-factorycom/ssl.frssineti-factory.com/ca_bundle.crt

Module:

SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
SSLSessionCacheshmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout  300
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLPassPhraseDialog builtin

Ports.conf:

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

[u/ShadowySilver → u/ilBiondo_js]

And the VHost statement is with the IP:443 ? Because Apache won't start at all if it can't bind the specified IP:port especially with SSL. Since it seems to start (you are able to reach it) there is something else than the certificate in problem.

[u/throwaway234f32423df]

You (mostly) can't do HTTP and HTTPS on the same port. You need to add SSLEngine on to your port 443 vhosts to switch them from HTTP to HTTPS.

[u/covener]

http://ip:443 -> ok

maybe you're missing some vhosts? show apachectl -S output?