# Getting ERR\_SSL\_PROTOCOL\_ERROR **URL:** \ **Category:** Help\ **Created:** [December 15, 2023, 4:25am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150 "2023-12-15T04:25:31Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 15, 2023, 4:25am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/1 "2023-12-15T04:25:32Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: os3-328-53799.vs.sakura.ne.jp My web server is (include version): Apache/2.4.57 (CentOS Stream) The operating system my web server runs on is (include version): CentOS Stream release 9 I can login to a root shell on my machine (yes or no, or I don't know): yes The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 2.6.0 **MORE INFORMATION:** I was able to access my website via https until the day before, but suddenly I can no longer access it. I tried it in both chrome and safari, but both gave the same error. I was able to access it with http without any problems. It seems that some error occurred during the certificate renewal process, but the expiration date was displayed as shown below. ```nohighlight sudo certbot certificates ``` Found the following certs: Certificate Name: os3-328-53799.vs.sakura.ne.jp Serial Number: \*\*\*\*\*\*\*\*\*\* Key Type: ECDSA Domains: os3-328-53799.vs.sakura.ne.jp Expiry Date: 2024-01-17 08:30:36+00:00 (VALID: 33 days) Certificate Path: /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/fullchain.pem Private Key Path: /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/privkey.pem Also, I simply set up a virtual host in the Apache settings to use for the certificate renewal , but I thought this was also one of the causes. The Apache configuration was as follows. \ ServerAdmin root@hogehoge DocumentRoot /var/www/html ServerName hogehoge Please tell this web server newbie how to solve this problem. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 15, 2023, 5:01am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/2 "2023-12-15T05:01:56Z")
Your Apache VirtualHost is not configured properly. Requests to port 443 should be for HTTPS. But, your Apache is handling it as an HTTP request. Let's start by having you show us what this says: ```nohighlight sudo apache2ctl -t -D DUMP_VHOSTS ``` If you have any NAT or port forwarding also review that to ensure port 443 inbound is directed to your server as port 443. Edit: oh, you probably need `httpd` in that command instead of apache2ctl ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 15, 2023, 6:58am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/3 "2023-12-15T06:58:37Z")
`sudo httpd -t -D DUMP_VHOSTS` AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf/httpd.conf:363 VirtualHost configuration: \*:80 hogehoge (/etc/httpd/conf/httpd.conf:365) The result is like this. ---
**Author:** ![tdebrecini](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@tdebrecini](https://community.letsencrypt.org/u/tdebrecini)\ **Post date:** [December 15, 2023, 9:19am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/4 "2023-12-15T09:19:15Z")
Yes, @MikeMcQ nailed it - you have a misconfiguration in your Apache configuration @Kiichi . If you check the site in Firefox, you will see the issue is "Connection not encrypted": ![Connection_not_ecrypted](https://global.discourse-cdn.com/letsencrypt/original/3X/9/1/9152cbacc61c4dfd56f58f8312d1a49ee1225eb4.png) The "httpd -t -D DUMP\_VHOSTS" should list the port 443 virtual host. Instead, you are getting the warning about using the NameVirtualHost directive on line 363 in httpd.conf. You need to have a VirtualHost configured for port 443 for your domain. The fact that I am getting this response on port 443, means that you are forwarding port 443 to port 80. ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 15, 2023, 11:23am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/5 "2023-12-15T11:23:09Z")
First of all, thank you for your reply. `NameVirtualHost *:80` (this was the line 443) ```nohighlight ServerAdmin root@hogehoge DocumentRoot /var/www/html ServerName hogehoge ``` I tried changing or deleting the above part of the Apache configuration file as follows, but the situation did not change. ```nohighlight NameVirtualHost *:443 ServerAdmin root@hogehoge DocumentRoot /var/www/html ServerName hogehoge ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 15, 2023, 4:28pm UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/6 "2023-12-15T16:28:07Z")
Those VirtualHosts are completely wrong for the domain os3-328-53799.vs.sakura.ne.jp I don't see how HTTPS requests ever worked. You must have made some big changes. Can you show the contents of this file: ```nohighlight /etc/letsencrypt/renewal/os3-328-53799.vs.sakura.ne.jp.conf ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [December 15, 2023, 5:16pm UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/7 "2023-12-15T17:16:59Z")
This doesn't show it bound to port 443: > [@Kiichi](#): > > AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf/httpd.conf:363 > VirtualHost configuration: > \*:80 hogehoge (/etc/httpd/conf/httpd.conf:365) This config is likely not enabled: > [@Kiichi](#): > > ```nohighlight > > ServerAdmin root@hogehoge > DocumentRoot /var/www/html > ServerName hogehoge > > > ``` Please show the output of: `netstat -pant | grep -i listen` ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 16, 2023, 12:58am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/8 "2023-12-16T00:58:33Z")
Thank you for your reply. The result of the command `cat /etc/letsencrypt/renewal/os3-328-53799.vs.sakura.ne.jp.conf` is as follows. ```nohighlight # renew_before_expiry = 30 days version = 2.6.0 archive_dir = /etc/letsencrypt/archive/os3-328-53799.vs.sakura.ne.jp cert = /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/cert.pem privkey = /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/privkey.pem chain = /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/chain.pem fullchain = /etc/letsencrypt/live/os3-328-53799.vs.sakura.ne.jp/fullchain.pem # Options used in the renewal process [renewalparams] account = 255a8f5b3979900aca8fda472e9f246c authenticator = apache server = https://acme-v02.api.letsencrypt.org/directory key_type = ecdsa installer = apache ``` ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 16, 2023, 1:07am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/9 "2023-12-16T01:07:58Z")
Thank you for your reply. `netstat -pant | grep -i listen` This command could not be executed. The result of running the alternative command is as follows. command: `ss -pnat` result: ```nohighlight State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* ESTAB 0 80 49.212.177.53:22 133.31.218.165:48647 LISTEN 0 128 [::]:22 [::]:* ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [December 16, 2023, 3:18am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/10 "2023-12-16T03:18:04Z")
> [@Kiichi](#): > > `LISTEN 0 511 0.0.0.0:443 0.0.0.0:*` Well... something is bound to port 443. What shows?: `ps -ef | grep -v grep | grep -Ei 'apache|nginx|http'` ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 16, 2023, 8:43am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/11 "2023-12-16T08:43:17Z")
The result of running the command `ps -ef | grep -v grep | grep -Ei 'apache|nginx|http'`was as follows. ```nohighlight apache 649 618 0 Dec12 ? 00:00:00 php-fpm: pool www apache 650 618 0 Dec12 ? 00:00:00 php-fpm: pool www apache 651 618 0 Dec12 ? 00:00:00 php-fpm: pool www apache 652 618 0 Dec12 ? 00:00:00 php-fpm: pool www apache 653 618 0 Dec12 ? 00:00:00 php-fpm: pool www root 33309 1 0 Dec15 ? 00:00:03 /usr/sbin/httpd -DFOREGROUND apache 33311 33309 0 Dec15 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND apache 33312 33309 0 Dec15 ? 00:00:13 /usr/sbin/httpd -DFOREGROUND apache 33313 33309 0 Dec15 ? 00:00:12 /usr/sbin/httpd -DFOREGROUND apache 33314 33309 0 Dec15 ? 00:00:12 /usr/sbin/httpd -DFOREGROUND apache 33594 33309 0 Dec15 ? 00:00:12 /usr/sbin/httpd -DFOREGROUND ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 16, 2023, 10:18am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/12 "2023-12-16T10:18:50Z")
> [@Kiichi](#): > > command: `ss -pnat` It is probably Apache listening on port 443 but can you run above command with sudo which will confirm that. Thanks ```nohighlight sudo ss -pnat ``` ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 16, 2023, 12:13pm UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/13 "2023-12-16T12:13:18Z")
the result was this. ```nohighlight State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=626,fd=3)) LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("httpd",pid=42305,fd=3),("httpd",pid=41660,fd=3),("httpd",pid=41659,fd=3),("httpd",pid=41658,fd=3),("httpd",pid=41655,fd=3)) LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("httpd",pid=42305,fd=4),("httpd",pid=41660,fd=4),("httpd",pid=41659,fd=4),("httpd",pid=41658,fd=4),("httpd",pid=41655,fd=4)) ESTAB 0 0 49.212.177.53:22 167.71.223.33:39328 users:(("sshd",pid=43311,fd=4),("sshd",pid=43310,fd=4)) ESTAB 0 0 49.212.177.53:22 43.153.77.20:53780 users:(("sshd",pid=43313,fd=4),("sshd",pid=43312,fd=4)) ESTAB 0 0 49.212.177.53:22 124.38.79.132:63185 users:(("sshd",pid=43275,fd=4),("sshd",pid=43257,fd=4)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=626,fd=4)) ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [December 16, 2023, 2:43pm UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/14 "2023-12-16T14:43:53Z")
You should create a new VirtualHost for this domain. It should at least have this much but add others as you need ```nohighlight ## ServerAdmin root@hogehoge # set as needed ServerName os3-328-53799.vs.sakura.ne.jp DocumentRoot /var/www/html ``` Check that this port 80 name is active by running ```nohighlight sudo httpd -t -D DUMP_VHOSTS ``` If it is, re-run the command you used originally which was ```nohighlight sudo certbot --apache -d os3-328-53799.vs.sakura.ne.jp ``` It might ask if you want to re-issue or just install. Just installing should work. You are missing the VirtualHost for this domain to process HTTPS. This certbot command should re-create that for you ---
**Author:** ![Kiichi](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kiichi/32/76392_2.png) [@Kiichi](https://community.letsencrypt.org/u/Kiichi)\ **Post date:** [December 17, 2023, 7:12am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/15 "2023-12-17T07:12:44Z")
I was able to successfully resolve the issue. Thank you for your cooperation over the past few days in resolving the issue. Now I can resume learning web servers. I'm really thankful to you. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 16, 2024, 7:13am UTC](https://community.letsencrypt.org/t/getting-err-ssl-protocol-error/210150/16 "2024-01-16T07:13:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.