# Problem to https:// in SSL Let's Encrypt **URL:** \ **Category:** Site Feedback\ **Created:** [March 17, 2017, 4:39pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090 "2017-03-17T16:39:42Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ivgenij](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ivgenij](https://community.letsencrypt.org/u/ivgenij)\ **Post date:** [March 17, 2017, 4:39pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/1 "2017-03-17T16:39:42Z")
Hello world, I use Shared hosting from [megahost.kz](http://megahost.kz) 4 of the 1st domain without https 2d with https from komodo 3rd spunel Inc. (comodo) 4th from Let’s Enkript 1,2,3 work quickly and perfectly but 4th that time it turned out that the low open PS forgive in Russian in translit ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 17, 2017, 5:14pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/2 "2017-03-17T17:14:41Z")
Hi @ivgenij, Did you use some kind of software application to obtain the certificates yourself? Or did the hosting provider obtain them for you using its own Let’s Encrypt tool, for example inside a control panel? If you obtained the certificates yourself, we may be able to help you if you can tell us what software you used, how you used it, and what kind of error messages you received. If the hosting company obtained the certificates, you’ll probably need to ask them for assistance. ---
**Author:** ![ivgenij](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ivgenij](https://community.letsencrypt.org/u/ivgenij)\ **Post date:** [March 17, 2017, 9:40pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/3 "2017-03-17T21:40:46Z")
I used to get SSL [zerossl.com](http://zerossl.com) ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [March 17, 2017, 9:47pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/4 "2017-03-17T21:47:06Z")
Hi, Unfortunately, I didn’t understand the translation of the part of your message where you described what went wrong with the fourth attempt. Could you try to describe it differently, or maybe try using a different machine translation program? Google Translate has gotten very good for many pairs of languages. Do you have any error messages that you saw as a result of what you were trying to do? ---
**Author:** ![leader](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/leader/32/7569_2.png) [@leader](https://community.letsencrypt.org/u/leader)\ **Post date:** [March 17, 2017, 9:54pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/5 "2017-03-17T21:54:33Z")
@ivgenij, try ZeroSSL [contact form](https://zerossl.com/#contact) - it might be easier to decipher your message then 🙂 I would imagine that it is either server misconfiguration (for example trying to use account key as a domain key) or mixed content on the site. Please note that ZeroSSL Certificate Wizard is available in Russian (in addition to English, German, French, Spanish and Italian) - switching to it might make the process easier for you if you are having troubles getting the certificate. ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [March 17, 2017, 10:13pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/6 "2017-03-17T22:13:24Z")
What is the name of your site? ---
**Author:** ![ivgenij](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ivgenij](https://community.letsencrypt.org/u/ivgenij)\ **Post date:** [March 18, 2017, 4:58am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/7 "2017-03-18T04:58:55Z")
[Https://cplaza.kz/](Https://cplaza.kz/) on this domain is SSL Let’s Encrypt sendered online at [zerossl.com](http://zerossl.com). When you try to open [https://cplaza.kz/](https://cplaza.kz/) it opens slowly Load ~ 20.90 s When I try to open [http://cplaza.kz/](http://cplaza.kz/) it opens quickly Load ~ 803 ms Also sometimes when you try to open [https://cplaza.kz/](https://cplaza.kz/) the browser does not open Time out at all [Https://pultmarket.kz/](Https://pultmarket.kz/) on this domain is SSL cPanel inc (comodo) When you try to open [http://pultmarket.kz/](http://pultmarket.kz/) it opens quickly Load ~ 1.15 s Both sites on the same hosting and ip Was used Chrome Version 56.0.2924.87 (64-bit), Firefox 52.0 (32-bit) ---
**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\ **Post date:** [March 18, 2017, 5:28am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/8 "2017-03-18T05:28:44Z")
Thanks for the extra info. This is a very interesting problem. I see the same result: The HTTPS version of your site loads very slowly for me with Chrome, Firefox, and curl. However, connecting directly with OpenSSL, and even requesting a page, is very fast: ```auto echo -e "GET / HTTP/1.1\nHost:cplaza.kz\n\n" | openssl s_client -connect cplaza.kz:443 -showcerts -servername cplaza.kz ``` Does anyone else have any ideas what could cause this behavior? I tried `curl --no-alpn`, which is also very slow. ---
**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\ **Post date:** [March 18, 2017, 8:09am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/9 "2017-03-18T08:09:20Z")
Whatever it is, it appears to add exactly 20 seconds to the SSL handshake. This does sound like some kind of timeout apache is running into internally. There’s a good chance that whatever it is, there’s a message about it in your apache error. If there isn’t, setting `LogLevel debug` might yield more results. (Side-note: I noticed your ISP is “JSC KazTransCom”. They were [in the news about a year ago](https://www.eff.org/deeplinks/2015/12/kazakhstan-considers-plan-snoop-all-internet-traffic) because of plans to man-in-the-middle all connections using a root certificate that they wanted all users to install manually. I thought this might be related to whatever they’re using to intercept TLS connections, but [a quick search on censys](https://censys.io/ipv4?q=443.https.tls.certificate.parsed.issuer.organization%3A+%22Let%27s+Encrypt%22+and+autonomous_system.name%3A+%22KTC-AS%22) for others on that network using Let’s Encrypt shows that they don’t seem to suffer from this problem, so it’s _probably_ not related, unless it’s something specific about your site or certificate that’s causing it.) ---
**Author:** ![leader](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/leader/32/7569_2.png) [@leader](https://community.letsencrypt.org/u/leader)\ **Post date:** [March 18, 2017, 8:25am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/10 "2017-03-18T08:25:18Z")
This is indeed interesting. For example, [Qualys test](https://www.ssllabs.com/ssltest/analyze.html?d=cplaza.kz&hideResults=on) indicates a lot of “Protocol or cipher suite mismatch” issues, while [Comodo test](https://sslanalyzer.comodoca.com/?url=cplaza.kz) receives certificate for [email.almadata.kz](http://email.almadata.kz) instead it seems. Additionally FireFox fails with SEC\_ERROR\_OCSP\_TRY\_SERVER\_LATER as well as openssl s\_client when used with `-status`, so you might [try this](https://loopbyte.com/blog/post/how-to-resolve-apache-ssl-website-error-secerrorocsptryserverlater), with some more details [here](https://forums.cpanel.net/threads/cpanel-firefox-apache-sec_error_ocsp_try_server_later.498171/)). It does look like a misconfiguration so far. There’s one more theory about slow handshakes too though - as far as I remember, Kazakhstan [was planning](https://digital.report/experts-concerned-kazakhstan-plans-to-monitor-users-encrypted-traffic/) to [introduce HTTPS traffic interception](https://news.ycombinator.com/item?id=10663843) - I wonder if that might explain slow handshakes. P.S. Apparently while I was writing this @pfg already checked censys, so might not be the case here, though still something to keep in mind I guess 🙂 ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [March 21, 2017, 9:51am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/11 "2017-03-21T09:51:10Z")
hi @ivgenij i can see you are using apache have a look at this article for apache > **[Error: sec\_error\_ocsp\_try\_server\_later \[SOLVED\] | Liquid Web Knowledge Base](https://www.liquidweb.com/kb/error-sec_error_ocsp_try_server_later-solved/)** > > Pre-Flight Check These instructions are intended specifically for solving the error: "sec\_error\_ocsp\_try\_server\_later". This error can be displayed anytime can you paste your apached configs here? I would also try a certificate from another provider (free) and see if you are getting the same issue If you are getting the same issue then you can definitely narrow it down to a web server config Andrei ---
**Author:** ![ivgenij](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ivgenij](https://community.letsencrypt.org/u/ivgenij)\ **Post date:** [March 23, 2017, 9:24pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/12 "2017-03-23T21:24:30Z")
[https://pultmarket.kz](https://pultmarket.kz) vs [https://cplaza.kz](https://cplaza.kz) one cms, one virtual host, one IP. Tomorrow, if the host will provide such information. ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [March 24, 2017, 9:46am UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/13 "2017-03-24T09:46:31Z")
hi @ivgenij check your apache host configurations i can see you are hosting both services on the same IP so the logical conclusion is that the difference is in the host configurations ![](https://global.discourse-cdn.com/letsencrypt/original/2X/a/ac58307bb74b13bf3efd44c7a371e68468ee9f7f.png) the certificate seems to be valid however your OCSP configuration seems to be of ![](https://global.discourse-cdn.com/letsencrypt/original/2X/1/1a109a3709310f392a97e62ff24fe6f55279840a.png) [https://wiki.apache.org/httpd/OCSPStapling](https://wiki.apache.org/httpd/OCSPStapling) > **[How to resolve Apache SSL website error : sec\_error\_ocsp\_try\_server\_later -...](https://loopbyte.com/blog/post/how-to-resolve-apache-ssl-website-error-secerrorocsptryserverlater)** > > Recently on one of our cPanel server we started getting error on SSL enabled sites in Firefox :- "The OCSP server suggests trying again later. if you compare your two sites with sslalbs [https://www.ssllabs.com/ssltest/analyze.html?d=pultmarket.kz&hideResults=on](https://www.ssllabs.com/ssltest/analyze.html?d=pultmarket.kz&hideResults=on) > **[SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=cplaza.kz&hideResults=on)** > > A comprehensive free SSL test for your public web servers. ![](https://global.discourse-cdn.com/letsencrypt/original/2X/8/8eb221075a2740ab17828693f2d67586c81092f3.png) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/3/34c76fc84e8261c5b8663b3b7474d732599492aa.png) the other thing that you may want to look at is that you are sending a certificate for non SNI queries which doesn't match it may be a good idea to fix it as other have had trouble with google treating that behavior as a self signed certificate > [@Self signed SSL/TLS certificate](https://community.letsencrypt.org/t/self-signed-ssl-tls-certificate/30354/3): > > I… ![](https://global.discourse-cdn.com/letsencrypt/original/2X/9/943ffec7af79c81b8668e6c2ef38dde5fd006810.png) ---
**Author:** ![ivgenij](https://avatars.discourse-cdn.com/v4/letter/i/edb3f5/32.png) [@ivgenij](https://community.letsencrypt.org/u/ivgenij)\ **Post date:** [March 24, 2017, 2:54pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/14 "2017-03-24T14:54:55Z")
The hosting provider says that the apache is configured for defaults and there will not be any changes in it. Installed a trial from SSL the Comodo [cplaza.kz](http://cplaza.kz) load ~2 s ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 23, 2017, 2:54pm UTC](https://community.letsencrypt.org/t/problem-to-https-in-ssl-lets-encrypt/30090/15 "2017-04-23T14:54:57Z")
Closed on April 23, 2017, 2:54pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.