47

I'm trying to configure Apache on my server to work with ssl, but everytime I visit my site, I get the following message in my browser:

SSL connection error. Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have. Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error.

The error message above seems to be native to Google Chrome. However, even though the messages are different, ssl for the site is not working on any browser.

Just some background on the situation: I am using Ubuntu 10.04 desktop edition.

I installed apache by installing zend server (it installed apache automatically). I then installed openssl. Non-https pages work fine on the site.
I tried getting trial certificates from multiple certificate sites but nothing is working (same error).
I was previously hosting my site on another server on which ssl worked just fine. I also tried using the key and cert file from that server, but I got the same error.

The domain name and IP are still the same though. My SSLCertificateFile and SSLCertificateKeyFile are pointing to the correct directory and files.

I also do not have SSLVerifyClient enabled.

If anyone has any suggestions, it would be most appreciated.

2
  • 5
    I just saw this post. It's been a while, but if anyone stumbles on this through google, I thought I'd post the fix anyway. The certificate was improperly installed. I usually try fixing things myself to learn it inside out, but since I was on a deadline, I had to bring in someone from oDesk to resolve the issue.
    – user396404
    Apr 16, 2011 at 20:13
  • since you forgot the precise steps, i listed everything i had to do, including a check of certificate and key integrity. UPVOTED QUESTION! :)
    – tony gil
    Dec 19, 2014 at 14:46

15 Answers 15

49

I had the same problem as @User39604, and had to follow VARIOUS advices. Since he doesnt remember the precise path he followed, let me list my path:

  1. check if you have SSL YES using <?php echo phpinfo();?>

  2. if necessary

    A. enable ssl on apache sudo a2enmod ssl

    B. install openssl sudo apt-get install openssl

    C. check if port 443 is open sudo netstat -lp

    D. if necessary, change /etc/apache2/ports.conf, this works

    NameVirtualHost *:80
    Listen 80
    
    <IfModule mod_ssl.c>
        # If you add NameVirtualHost *:443 here, you will also have to change
        # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
        # to <VirtualHost *:443>
        # Server Name Indication for SSL named virtual hosts is currently not
        # supported by MSIE on Windows XP.
        NameVirtualHost *:443
        Listen 443
    </IfModule>
    
    <IfModule mod_gnutls.c>
        Listen 443
    </IfModule>
    
  3. acquire a key and a certificate by

    A. paying a Certificating Authority (Comodo, GoDaddy, Verisign) for a pair

    B. generating your own* - see below (testing purposes ONLY)

  4. change your configuration (in ubuntu12 /etc/apache2/httpd.conf - default is an empty file) to include a proper <VirtualHost> (replace MYSITE.COM as well as key and cert path/name to point to your certificate and key):

    <VirtualHost _default_:443> 
    ServerName MYSITE.COM:443
    SSLEngine on
    SSLCertificateKeyFile /etc/apache2/ssl/MYSITE.COM.key
    SSLCertificateFile /etc/apache2/ssl/MYSITE.COM.cert
    ServerAdmin MYWEBGUY@localhost
    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>
    
    
    ErrorLog ${APACHE_LOG_DIR}/errorSSL.log
    
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    
    CustomLog ${APACHE_LOG_DIR}/accessSSL.log combined
    
    </VirtualHost>
    

while many other virtualhost configs wil be available in /etc/apache2/sites-enabled/ and in /etc/apache2/sites-available/ it was /etc/apache2/httpd.conf that was CRUCIAL to solving all problems.

for further info:

http://wiki.vpslink.com/Enable_SSL_on_Apache2

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#selfcert

*generating your own certificate (self-signed) will result in a certificate whose authority the user's browser will not recognize. therefore, the browser will scream bloody murder and the user will have to "understand the risks" a dozen times before the browser actually opens up the page. so, it only works for testing purposes. having said that, this is the HOW-TO:

  1. goto the apache folder (in ubuntu12 /etc/apache2/)
  2. create a folder like ssl (or anything that works for you, the name is not a system requirement)
  3. goto chosen directory /etc/apache2/ssl
  4. run sudo openssl req -new -x509 -nodes -out MYSITE.COM.crt -keyout MYSITE.COM.key
  5. use MYSITE.COM.crt and MYSITE.COM.key in your <VirtualHost> tag

name format is NOT under a strict system requirement, must be the same as the file :) - names like 212-MYSITE.COM.crt, june2014-Godaddy-MYSITE.COM.crt should work.

7
  • 1
    For me it was the missing '<Directory/>' settings
    – Karl
    Jan 4, 2016 at 15:33
  • 1
    You don't necessarily have to pay for the certificate. StartSSL offers free certificates and are commonly recognized.
    – Pete
    Mar 8, 2016 at 22:45
  • 1
    I realize this is an old answer, but I just found it today and it solved my problems. Something to note however: the end tag for the httpd.conf file should be </VirtualHost> and not </Directory>. I edited the original answer, but I don't know if it will be accepted since this has been inactive for a year. Jul 1, 2016 at 6:16
  • 8
    I did all this without a single success... fortunately actually enabling the site with sudo a2ensite default-ssl.conf was a correct solution...ugh. Apr 10, 2017 at 15:11
  • 1
    for me, until step 3, this command works : sudo a2ensite default-ssl.conf Jul 6, 2019 at 3:40
24

I was getting the same error in chrome (and different one in Firefox, IE). Also in error.log i was getting [error] [client cli.ent.ip.add] Invalid method in request \x16\x03 Following the instructions form this site I changed my configuration FROM:

<VirtualHost subdomain.domain.com:443>

   ServerAdmin [email protected]
   ServerName subdomain.domain.com

   SSLEngine On
   SSLCertificateFile conf/ssl/ssl.crt
   SSLCertificateKeyFile conf/ssl/ssl.key
</VirtualHost>

TO:

<VirtualHost _default_:443>

   ServerAdmin [email protected]
   ServerName subdomain.domain.com

   SSLEngine On
   SSLCertificateFile conf/ssl/ssl.crt
   SSLCertificateKeyFile conf/ssl/ssl.key
</VirtualHost>

Now it's working fine :)

3
  • I had the same problem with *:433 Changing this to default:433 made it work in Chrome, whereas it was intermittent before. Dec 1, 2013 at 16:51
  • 2
    please clarify changes to which files resulted in success, since you can edit httpd.conf as well as sites-enabled/000-default , sites-available/default-ssl , sites-available/yoursite.com. must also check if SSL is running on server.
    – tony gil
    Dec 19, 2014 at 13:32
  • never knew what default stands for, now it makes sense after all the hassle of not being able to push 443 content today
    – user591272
    Jun 13, 2017 at 0:30
9

Step to enable SSL correctly.

sudo a2enmod ssl  
sudo apt-get install openssl

Configure the path of SSL certificates in your SSL config file (default-ssl.conf) that might be located in /etc/apache2/sites-available. I have stored certificates under /etc/apache2/ssl/

SSLEngine On
SSLCertificateFile /etc/apache2/ssl/certificate.crt
SSLCertificateChainFile /etc/apache2/ssl/ca_bundle.crt
SSLCertificateKeyFile /etc/apache2/ssl/private.key

Enable SSL config file

sudo a2ensite default-ssl.conf
1
  • SSLCertificateChainFile is deprecated. You should put your intermediate CA certificates in the same file as your SSL Cert. yesterday
7

A common cause I wanted to suggest for this situation:

Sometimes a customer is running Skype, which is using port 443 without their realizing it. When they go to start Tomcat or Apache, it appears to start but cannot bind with port 443. This is the exact message that the user would receive in the browser. The fix is to stop what was running on port 443 and re-start the webserver so it can bind with port 443.

The customer can re-start Skype after starting the webserver, and Skype will detect that port 443 is in use and choose a different port to use.

6
#Make sure that you specify the port for both http and https ie.
NameVirtualHost:80
NameVirtualHost:443
#and 
<VirtualHost *:80>
<VirtualHost *:443>

#mixing * and *:443 does not work it has to be *:80 and *:443
3
  • Can you provide some explanation? Sep 23, 2012 at 3:34
  • 1
    The wildcard '*' matches all domains and all ports - so if you want to add specific virtual hosts for SSL you cannot simply use <VirtualHost *> (which is perfectly valid and will match all requests) - you have to distinguish between the two wildcard entries by specifying the port number. ie. *:80 for HTTP and *:443 for HTTPS
    – Jeremy
    Oct 4, 2012 at 20:09
  • this is one important issue to watch. i list a couple of others in my answer.
    – tony gil
    Dec 19, 2014 at 14:42
2

I got this problem and the solution was a bit silly.

I am using Cloudflare which acts as a proxy to my website. In order to be able to login via SSH, I added an entry to my /etc/hosts file so I didn't need to remember my server's IP address.

xxx.xx.xx.xxx  example.com

So in my browser when I went to https://www.example.com, I was using the Cloudflare proxy, and when I went to to https://example.com I was going directly to the server. Because the Cloudflare setup doesn't require you to add the intermediate certificates, I was seeing this security exception in my browser when I went to https://example.com, but https://www.example.com was working.

The solution: remove the entry from my laptop's /etc/hosts file.

If this isn't your problem, I recommend using one of the many online SSL checker tools to try diagnose your problem.

I also recommend using ping to check the IP address being reported and check it against the IP address expected.

ping https://www.example.com/

Another very helpful SSL resource is the Mozilla SSL Configuration Generator. It can generate SSL configuration for you.

1

I didn't know what I was doing when I started changing the Apache configuration. I picked up bits and pieces thought it was working until I ran into the same problem you encountered, specifically Chrome having this error.

What I did was comment out all the site-specific directives that are used to configure SSL verification, confirmed that Chrome let me in, reviewed the documentation before directive before re-enabling one, and restarted Apache. By carefully going through these you ought to be able to figure out which one(s) are causing your problem.

In my case, I went from this:

SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StdEnvVars +StrictRequire
SSLRequireSSL On

to this

<Location /sessions>
  SSLRequireSSL
  SSLVerifyClient require
</Location>

As you can see I had a fair number of changes to get there.

1

I had this error when I first followed instructions to set up the default apache2 ssl configuration, by putting a symlink for /etc/apache2/sites-available/default-ssl in /etc/apache2/sites-enabled. I then subsequently tried to add another NameVirtualHost on port 443 in another configuration file, and started getting this error.

I fixed it by deleting the /etc/apache2/sites-enabled/default-ssl symlink, and then just having these lines in another config file (httpd.conf, which probably isn't good form, but worked):

NameVirtualHost *:443

<VirtualHost *:443>
  SSLEngine on
  SSLCertificateChainFile    /etc/apache2/ssl/chain_file.crt
  SSLCertificateFile    /etc/apache2/ssl/site_certificate.crt
  SSLCertificateKeyFile /etc/apache2/ssl/site_key.key
  ServerName www.mywebsite.com
  ServerAlias www.mywebsite.com
  DocumentRoot /var/www/mywebsite_root/


</VirtualHost>
1

I encounter this problem, because I have <VirtualHost> defined both in httpd.conf and httpd-ssl.conf.

in httpd.conf, it's defined as

<VirtualHost localhost>

in httpd-ssl.conf, it's defined as

<VirtualHost _default_:443>

The following change solved this problem, add :80 in httpd.conf

<VirtualHost localhost:80>
1

This is what fixed it for me on Ubuntu.

  1. Enabled the module: a2enmod ssl
  2. Moved all cert related files to a folder /usr/local/ssl and made it world readable: chmod -R +r /usr/local/ssl
  3. Changed <VirtualHost *:80> to <VirtualHost *:*> in my virtual host.
  4. Added SSLEngine On before all other SSL directives in my virtual host.

If you set a pass phrase on the cert, Apache should prompt you for it on restart.

1
  • 1
    Instead of making the SSLs world readable, it's much more secure to grant apache access: usermod -aG ssl-cert www-data
    – rich remer
    Apr 8, 2015 at 20:07
1

Similar to other answers, this error can be experienced when there are no sites configured to use SSL.

I had the error when I upgraded from Debian Wheezy to Debian Jessie. The new version of Apache requires a site configuration file ending in .conf. Because my configuration file didn't, it was being ignored, and there were no others configured to serve SSL connections.

0

I encountered this issue, also due to misconfiguration. I was using tomcat and in the server.xml had specified my connector as such:

<Connector port="17443" SSLEnabled="true"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keyAlias="wrong" keystorePass="secret"
           keystoreFile="/ssl/right.jks" />

When i fixed it thusly:

<Connector port="17443" SSLEnabled="true"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keyAlias="right" keystorePass="secret"
           keystoreFile="/ssl/right.jks" />

It worked as expected. In other words, verify that you not only have the right keystore, but that you have specified the correct alias underneath it. Thanks for the invaluable hint user396404.

1
  • 4
    This question is about Apache Httpd, not Apache Tomcat.
    – Bruno
    Apr 29, 2012 at 17:17
0

I solved it by commenting out:

AcceptFilter https none

in httpd.conf

according to: http://www.apachelounge.com/viewtopic.php?t=4461

0

For me this literally was an invalid protocol. My virtual host specified valid protocols like this:

SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

This line was causing the error message, something to do with "-TLSv1". However, I ended up changing it to:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Problem solved!

-7

It turns out that the SSL certificate was installed improperly. Re-installing it properly fixed the problem

3
  • 8
    I would love it if you improved this answer. What did you do incorrectly? What was it before, and what was it afterwards? How did you figure out it was install incorrectly? Nov 26, 2012 at 3:03
  • 6
    To be honest, I was in a rush and hired a consultant to come in and re-install the certificate. This was so far back I don't really remember the exact details. I apologize for the lack of further information.
    – user396404
    Nov 27, 2012 at 14:54
  • @user396404 your advice was one of the hidden clues, though i had to follow many other steps here. i compiled everything in one answer. your answer was one very hard to find/identify issue that i ran into. UPVOTED! :)
    – tony gil
    Dec 19, 2014 at 14:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.