# Apache Server does not recognize certificates **URL:** \ **Category:** Server\ **Created:** [February 28, 2019, 6:03pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422 "2019-02-28T18:03:44Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [February 28, 2019, 6:03pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/1 "2019-02-28T18:03:44Z")
Dear all, my [Cloud Server](http://ericsowncloud.ddns.net/nextcloud) is reachable via HTTP. In order to make HTTPS work, I created my own certificate and got the response: > - Congratulations! Your certificate and chain have been saved at: > /etc/letsencrypt/live/ericsowncloud.ddns.net/fullchain.pem > Your key file has been saved at: > /etc/letsencrypt/live/ericsowncloud.ddns.net/privkey.pem In `/etc/apache2/sites-available/default-ssl.conf` I changed the entries as follows: ```nohighlight SSLCertificateFile /etc/letsencrypt/live/ericsowncloud.ddns.net/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/ericsowncloud.ddns.net/privkey.pem ``` Then, I did `sudo a2ensite default-ssl.conf` and `sudo service apache2 restart` With HTTPS, my server however [responds](https://ericsowncloud.ddns.net/nextcloud) with `ERR_SSL_PROTOCOL_ERROR`. What else do I have to do? ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [February 28, 2019, 6:21pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/2 "2019-02-28T18:21:17Z")
Hi, Could you please share us the full file of `/etc/apache2/sites-available/default-ssl.conf`? Thank you ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 6:35pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/3 "2019-02-28T18:35:42Z")
Hi @Eric-Sommer > [@Eric-Sommer](#): > > With HTTPS there is no https ( [https://check-your-website.server-daten.de/?q=ericsowncloud.ddns.net](https://check-your-website.server-daten.de/?q=ericsowncloud.ddns.net) ): | Domainname | Http-Status | redirect | Sec. | G | | --- | --- | --- | --- | --- | | • [http://ericsowncloud.ddns.net/](http://ericsowncloud.ddns.net/) | | | | | | 87.78.238.99 | 200 | | 0.093 | H | | | | | | | | • [http://ericsowncloud.ddns.net/](http://ericsowncloud.ddns.net/) | | | | | | 2001:4dd6:aa54:0:bfea:4b4c:3082:b21f | -14 | | 10.016 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [https://ericsowncloud.ddns.net/](https://ericsowncloud.ddns.net/) | | | | | | 87.78.238.99 | -4 | | 0.157 | W | | SendFailure - The underlying connection was closed: An unexpected error occurred on a send. The handshake failed due to an unexpected packet format. | | | | | | | | | | | | • [https://ericsowncloud.ddns.net/](https://ericsowncloud.ddns.net/) | | | | | | 2001:4dd6:aa54:0:bfea:4b4c:3082:b21f | -14 | | 10.016 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [http://ericsowncloud.ddns.net:443/](http://ericsowncloud.ddns.net:443/) | | | | | | 87.78.238.99 | 200 | | 0.080 | Q | | | | | | | | • [http://ericsowncloud.ddns.net:443/](http://ericsowncloud.ddns.net:443/) | | | | | | 2001:4dd6:aa54:0:bfea:4b4c:3082:b21f | -14 | | 10.030 | A | | Timeout - The operation has timed out | | | | | Instead, your port 443 sends a typical error: > The handshake failed due to an unexpected packet format. And answers with http on port 443, there is a http status 200, if a http query is sent to port 443. So your `default-ssl.conf` doesn't work. Perhaps share the content of the complete file. ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [February 28, 2019, 6:37pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/4 "2019-02-28T18:37:42Z")
Thanks…attached the full `ssl_default.conf` (renamed here) [ssl\_default.txt](https://global.discourse-cdn.com/letsencrypt/original/3X/e/c/ec0b188ff59c45fcbfae252a5dd939e0b70ef4e9.txt) (6.2 KB) ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 28, 2019, 6:44pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/5 "2019-02-28T18:44:30Z")
Is `mod_ssl` loaded? ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [February 28, 2019, 6:47pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/6 "2019-02-28T18:47:03Z")
Entering `sudo a2enmod ssl` gives me ```auto Considering dependency setenvif for ssl: Module setenvif already enabled Considering dependency mime for ssl: Module mime already enabled Considering dependency socache_shmcb for ssl: Module socache_shmcb already enabled Module ssl already enabled ``` So I assume yes. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 7:27pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/7 "2019-02-28T19:27:42Z")
Perhaps I have an idea. A few days ago a user had a special problem, I’ve added a check of the Html-content of a page. Added that to the http - over - 443 - check - [https://check-your-website.server-daten.de/?q=ericsowncloud.ddns.net](https://check-your-website.server-daten.de/?q=ericsowncloud.ddns.net) And the result: | Domainname | Http-Status | redirect | Sec. | G | | --- | --- | --- | --- | --- | | • [http://ericsowncloud.ddns.net/](http://ericsowncloud.ddns.net/) | | | | | | 87.78.238.99 | 200 | | 0.076 | H | | | | | | | | • [http://ericsowncloud.ddns.net/](http://ericsowncloud.ddns.net/) | | | | | | 2001:4dd6:aa54:0:bfea:4b4c:3082:b21f | -14 | | 10.030 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [https://ericsowncloud.ddns.net/](https://ericsowncloud.ddns.net/) | | | | | | 87.78.238.99 | -4 | | 0.127 | W | | SendFailure - The underlying connection was closed: An unexpected error occurred on a send. The handshake failed due to an unexpected packet format. | | | | | | | | | | | | • [https://ericsowncloud.ddns.net/](https://ericsowncloud.ddns.net/) | | | | | | 2001:4dd6:aa54:0:bfea:4b4c:3082:b21f | -14 | | 10.013 | T | | Timeout - The operation has timed out | | | | | | | | | | | | • [http://ericsowncloud.ddns.net:443/](http://ericsowncloud.ddns.net:443/) | | | | | | 87.78.238.99 | 200 | | 0.093 | Q | | Visible Content: Index of / NameLast modifiedSizeDescription nextcloud/2018-06-11 10:22 -   Apache/2.4.25 (Raspbian) Server at [ericsowncloud.ddns.net](http://ericsowncloud.ddns.net) Port 80 | | | | | | | | | | | The “Visible Content” (all Html-elements removed) connecting your server via port 443 - is answered via port 80, not via port 443. Do you have a router? Does this router send port 443 to port 80? Your router must send incoming port 443 to your 443 port of your Apache. ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [February 28, 2019, 7:33pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/8 "2019-02-28T19:33:32Z")
Yes I have a Fritzbox, but Port 443 is routed to Port 443, see attachment. ![Screenshot_2019-02-28_20-32-37](https://global.discourse-cdn.com/letsencrypt/original/3X/4/9/4984c00a165ca19b208f2fd7d8754ebfc94d67ca.png) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 7:42pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/9 "2019-02-28T19:42:52Z")
If your router settings are correct, then you may have an error in your main apache config file. So your SSL-config isn’t used. So share that file. ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [February 28, 2019, 8:14pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/10 "2019-02-28T20:14:22Z")
`apache2.conf` attached. I can’t recall touching this file at all.[apache2.txt](https://global.discourse-cdn.com/letsencrypt/original/3X/6/f/6fdfb7fea15ac9bad38d1164c55fed850e847386.txt) (7.1 KB) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 9:51pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/11 "2019-02-28T21:51:07Z")
I don’t see an error. Is `ports.conf` correct? Is there a second listen 443 directive? Your SSL-default: Why is Listen 443 outside the `` block? Put it inside. Perhaps there is another config running -\> one reboot. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 28, 2019, 10:24pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/12 "2019-02-28T22:24:10Z")
> [@JuergenAuer](#): > > And answers with http on port 443, there is a http status 200, if a http query is sent to port 443. This is the really important detail—the server is speaking HTTP instead of HTTPS on port 443. You can probably tell whether the problem is on the server or on the router by trying to connect from _inside_ the router. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 28, 2019, 10:28pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/13 "2019-02-28T22:28:07Z")
> [@schoen](#): > > You can probably tell whether the problem is on the server or on the router by trying to connect from _inside_ the router. That's a good idea. Use this url: ```nohighlight http://ericsowncloud.ddns.net:443/ ``` ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 28, 2019, 11:16pm UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/14 "2019-02-28T23:16:04Z")
(this might cause some difficulties if the server has a different IP address as seen from the inside and outside and if this difference isn’t reflected in DNS records as seen from those perspectives) ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [March 1, 2019, 9:01am UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/15 "2019-03-01T09:01:45Z")
After the reboot, the server apparently does not properly boot. Since I’m not at home for the next days, I’ll have to postpone your suggestions 🙂 ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [March 1, 2019, 9:32am UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/16 "2019-03-01T09:32:46Z")
> [@Eric-Sommer](#): > > After the reboot, the server apparently does not properly boot. Oh, that's bad. But you may have an inconsistent system, so it's good to fix that. Sometimes there are users with orphan-Apache-processes. An old Apache process doesn't terminate and answers, changes are not visible. A reboot stops that. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [March 1, 2019, 9:34am UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/17 "2019-03-01T09:34:52Z")
> [@JuergenAuer](#): > > A reboot stops that. On a \*nix server, it's almost **never** required to do a reboot. ---
**Author:** ![Eric-Sommer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eric-sommer/32/29769_2.png) [@Eric-Sommer](https://community.letsencrypt.org/u/Eric-Sommer)\ **Post date:** [March 8, 2019, 5:00am UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/18 "2019-03-08T05:00:58Z")
I set up everything from scratch again and now it’s working. Thank you all! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 7, 2019, 5:01am UTC](https://community.letsencrypt.org/t/apache-server-does-not-recognize-certificates/87422/19 "2019-04-07T05:01:00Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.