Err_ssl_protocol_error

Help
1

Hi all,

Banging my head against the wall trying to figure out this error.

This is for a fresh brand new install on my own private server of:

Ubuntu20.04LTS
nginx version: nginx/1.18.0 (Ubuntu)
certbot 1.13.0 snap

Looks like certbot is functioning properly as it is created new certs.

This is the first part of my nginx conf file:

server {
    if ($host = www.domain2.com) {
        return 301 https://$host$request_uri;
    }

    if ($host = domain2.com) {
        return 301 https://$host$request_uri;
    }

    if ($host = www.domain1.com) {
        return 301 https://$host$request_uri;
    }

    if ($host = domain1.com) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    listen [::]:80;
    server_name domain1.com www.domain1.com domain2.com www.domain2.com;
    
    return 301 https://$server_name$request_uri;

}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name domain1.com www.domain1.com domain2.com www.domain2.com;
    ssl_certificate /etc/letsencrypt/live/domain2.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain2.com/privkey.pem;
    ssl_session_tickets off;

UFW has both 80 and 443
router firewall redirected

I can't see the forest from the trees

Any assistance would be greatly appreciated

2

Hi @Heetered,

There needs to be a separate server block that says listen 443 ssl or similar, and there must not be any server block that says listen 443 without the ssl.

You could try

grep -r 443 /etc/nginx

to find files that refer to port 443 in your nginx configuration.

3

Thank you for responding so quickly

Hi this is the output:

root@webserv:/etc/letsencrypt# grep -r 443 /etc/nginx
/etc/nginx/sites-available/nextcloud:    listen 443 ssl http2;
/etc/nginx/sites-available/nextcloud:    listen [::]:443 ssl http2;
/etc/nginx/sites-available/default:	# listen 443 ssl default_server;
/etc/nginx/sites-available/default:	# listen [::]:443 ssl default_server;
root@webserv:/etc/letsencrypt#

Don't quite understand what you mean by the listen 443 without ssl

This is the output of the conf file that I am working with

I am thinking that you didn't scroll down enough on the code section in my first post. LOLOL

4

True! Sorry about that.

Are you sure that port 443 is forwarded to port 443? Could you share your domain name so we could see more about the origin of the protocol error?

5

EDIT:::::

DOH!

I checked my router again forwarding to port 433 instead, DUH!!!!!!!!!!!!

Thanks for your help again schoen, LOLOL

Going to go hide under a rock