Welcome! Log In Create A New Profile

Advanced

curl "Connection refused" caused by SSL config

March 04, 2015 08:10PM
Hi all,

I have a strange problem with nginx:
I tried to harden the TLS stack by setting default to recommended values from https://wiki.mozilla.org/Security/Server_Side_TLS but one server has to keep backward compatibility -- so I set it up as

http {
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers ...
ssl_prefer_server_ciphers on;

server {
listen 443 spdy;
server_name .foo.com bar.foo.com;
}
server {
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ...
ssl_prefer_server_ciphers on;

listen 443 spdy;
server_name foobar.foo.com;
}

}


Problem is that foobar.foo.com starts freezing up randomly after a few seconds -- though sometimes comes back for a short while.
curl from outside reports error as "connection refused"; using curl localhost:443 responds properly with "* SSL: no alternative certificate subject name matches target host name 'localhost'"
CPU usage is not much different from older config; there are no obvious errors in error_log.

Problem goes away if http-level ssl config is commented out (ssl_protocols, especially). I think that indicates this config is not properly parsed at the "server" level (does not override http level?)
Seems that I can use the http-level config inside .foo.com server config without interfering, but I'd like it to be config default instead.

Other notes: 2 nginx hosts in questions are behind a hardware load balancer
Subject Author Posted

curl "Connection refused" caused by SSL config

Fry-kun March 04, 2015 08:10PM

Re: curl "Connection refused" caused by SSL config

Fry-kun March 04, 2015 08:17PM

Re: curl "Connection refused" caused by SSL config

Fry-kun March 05, 2015 09:58PM

Re: curl "Connection refused" caused by SSL config

clementsm March 06, 2015 04:51AM

Re: curl "Connection refused" caused by SSL config

Maxim Dounin March 06, 2015 07:48AM

Re: curl "Connection refused" caused by SSL config

Fry-kun March 06, 2015 01:34PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 87
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready