# "Secure Connection Failed" Error when trying to connect to HTTPS

**URL:** <https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564>\
**Category:** Help\
**Created:** [May 14, 2019, 3:28pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564 "2019-05-14T15:28:59Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 14, 2019, 3:28pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/1 "2019-05-14T15:28:59Z")

</div>

I am trying to set up a [**Discourse**](https://www.discourse.org/) VM (with [Ubuntu Server 18.0.4.2 LTS](https://www.ubuntu.com/download/server) as the main OS) that is reverse proxying through an [**Nginx**](https://www.nginx.com/) VM (with [Ubuntu Server 18.0.4.2 LTS](https://www.ubuntu.com/download/server) as the main OS).

I can connect to the HTTP instance, but not HTTPS. I suspect the issue I’m running into is related to the Let’s Encrypt Key/Cert pair as I’m receiving **Secure Connection Failed** when I try logging into it. [Please see **THIS** post (and the one below)](https://meta.discourse.org/t/using-a-certificate-when-discourse-is-installed-behind-a-reverse-proxy/117226/11) from the Discourse Forum community for additional details (although there I use “**[myreserveddns.com](http://myreserveddns.com)**” _in place of_ “**[epochgames.co.uk](http://epochgames.co.uk)**”).

**My domain is:** [https://board.epochgames.co.uk](https://board.epochgames.co.uk) (more accurately [https://board.myreserveddns.com:2045](https://board.myreserveddns.com:2045))

**I ran this command:** Ran `letsencrypt certonly` on the Discourse server to create the key/cert pair, and SCPed them to `/etc/nginx/ssl/` on the Nginx server. [I have been following this guide.](https://www.howtoforge.com/tutorial/how-to-install-and-configure-discourse-forum-with-nginx-on-ubuntu-1604/)

**It produced this output:** “Secure Connection Failed” when I try to connect to the HTTPS site in a browser. No errors when I connect to the HTTP site ([http://board.myreserveddns.com:2045](http://board.myreserveddns.com:2045))

**My web server is (include version):** I am setting up the Discourse and Nginx VMs on a Dell PowerEdge server with [Proxmox VE 5.3](https://www.proxmox.com/en/downloads/category/iso-images-pve) as the main OS. The “[epochgames.co.uk](http://epochgames.co.uk)” domain is registered with [123-Domains](https://www.123-reg.co.uk/), the subdomains (“board” in this case) is set up in a [Plesk Onyx 17.8.11](https://docs.plesk.com/release-notes/onyx/whats-new/) from [UnlimitedWebHosting](https://www.unlimitedwebhosting.co.uk/).

**The operating system my web server runs on is (include version):** I think I explained this enough up above, yes?

**My hosting provider, if applicable, is:** Again, I believe is explained above.

**I can login to a root shell on my machine (yes or no, or I don’t know):** Yes to the Proxmox Server and all the VMs inside it (the server is literally sitting in my home). The 123-Domains account and the UnlimitedWebHosting Plesk Server is all hosted in the Cloud, so no to those two.

**I’m using a control panel to manage my site (no, or provide the name and version of the control panel):** I think I’ve provided such details above.

**The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot):** I think I’ve provided such details above.

If you need me to provide details, please let me know.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 14, 2019, 3:58pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/2 "2019-05-14T15:58:00Z")

</div>

Hi @naupe1

> [@naupe1](#):
>
> The “[epochgames.co.uk](http://epochgames.co.uk)” domain is registered with [123-Domains](https://www.123-reg.co.uk/), the subdomains (“board” in this case) is set up in a [Plesk Onyx 17.8.11](https://docs.plesk.com/release-notes/onyx/whats-new/) from [UnlimitedWebHosting](https://www.unlimitedwebhosting.co.uk/).

that can't work. This Plesk setting is only a local setting. Result: Your subdomain doesn't exist ( [https://check-your-website.server-daten.de/?q=boards.epochgames.co.uk](https://check-your-website.server-daten.de/?q=boards.epochgames.co.uk) ):

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [boards.epochgames.co.uk](http://boards.epochgames.co.uk) | | Name Error | yes | 1 | 0 |
| [www.boards.epochgames.co.uk](http://www.boards.epochgames.co.uk) | | Name Error | yes | 1 | 0 |

Same with your other domain.

You have to create that entry in your domain management menu of 123-Domains, if you want a certificate with that domain name.

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 14, 2019, 4:22pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/3 "2019-05-14T16:22:31Z")

</div>

I’m an idiot, I meant to put **[board.epochgames.co.uk](http://board.epochgames.co.uk)**, _not_ [boards.epochgames.co.uk](http://boards.epochgames.co.uk) in the original post (which I’ve updated)

What about _that_ Domain Name?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 14, 2019, 4:31pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/4 "2019-05-14T16:31:25Z")

</div>

> [@naupe1](#):
>
> What about _that_ Domain Name?

There is a correct DNS entry ( [https://check-your-website.server-daten.de/?q=board.epochgames.co.uk](https://check-your-website.server-daten.de/?q=board.epochgames.co.uk) ):

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [board.epochgames.co.uk](http://board.epochgames.co.uk) | A | 96.244.131.200 | yes | 1 | 0 |
| | AAAA | | yes | | |
| [www.board.epochgames.co.uk](http://www.board.epochgames.co.uk) | | Name Error | yes | 1 | 0 |

But from outside, there are only timeouts visible:

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://board.epochgames.co.uk/](http://board.epochgames.co.uk/) | | | | |
| 96.244.131.200 | -14 | | 10.027 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/) | | | | |
| 96.244.131.200 | -14 | | 10.024 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [http://board.epochgames.co.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://board.epochgames.co.uk/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 96.244.131.200 | -14 | | 10.027 | T |
| Timeout - The operation has timed out | | | | |
| Visible Content: | | | | |
| | | | | |

Same checking Port 2045.

So I don't know if there is a working certificate.

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 14, 2019, 4:40pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/5 "2019-05-14T16:40:38Z")

</div>

Right, so the server is actually down right now (and is, in fact, most of the day, as its not seeing active usage yet).

However, I now have these handy links to test this out myself. When I have time to turn on my server (and the VMs) I will test this out and post the results in this topic. Then from there I’m sure better troubleshooting results can occur.

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 15, 2019, 2:24am UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/6 "2019-05-15T02:24:20Z")

</div>

So, I have my Server running now. I must admit I’m not really sure how this “check-your-website-server” site works. [**board.epochgames.co.uk**](http://board.epochgames.co.uk) is accurate, and when I type in [**www.board.epochgames.co.uk**](http://www.board.epochgames.co.uk) I get “No IP-Adresses found.”

Moving on to the Domain Name test, this is what I receive:

| **Domain Name** | **What Happens?** |
| --- | --- |
| [http://board.epochgames.co.uk/](http://board.epochgames.co.uk/) | Redirects to [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/) |
| [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/) | “ **Secure Connection Failed:** The connection to [board.epochgames.co.uk](http://board.epochgames.co.uk) was interrupted while the page was loading.” |
| [http://board.epochgames.co.uk:2045](http://board.epochgames.co.uk:2045) | “ **Congratulations, you installed Discourse!** ” (the message I expect to see) |
| [https://board.epochgames.co.uk:2045](https://board.epochgames.co.uk:2045) | “ **Secure Connection Failed:** An error occurred during a connection to [board.epochgames.co.uk:2045](http://board.epochgames.co.uk:2045). SSL received a record that exceeded the maximum permissible length. Error code: SSL\_ERROR\_RX\_RECORD\_TOO\_LONG” |

As I mentioned in the OP: I created the Key/Cert pair on the **Discourse VM** and then SCPed it to the **Nginx VM**. [I then link to the Key/Cert Pair in the Nginx conf file as mentioned in this Discourse forum post.](https://meta.discourse.org/t/using-a-certificate-when-discourse-is-installed-behind-a-reverse-proxy/117226/11)

Where did I go wrong?

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 15, 2019, 3:01am UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/7 "2019-05-15T03:01:36Z")

</div>

**UPDATE:** Ok @JuergenAuer, I think I’ve realized the problem is likely with the Key/Cert Pair. I have updated my Nginx CONF file as follows:

```
server {
    listen 80; listen [::]:80;
    server_name boards.epochgames.co.uk;

    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    return 301 https://$host$request_uri;
}

server {
    # The IP that you forwarded in your router (nginx proxy)
    listen 443 ssl http2; listen [::]:443 ssl http2;

    # Make site accessible from http://localhost/
    server_name boards.epochgames.co.uk;
    root /home/lighttpd/http;

    # SSL config
    # ssl on;
    ssl_certificate /etc/nginx/ssl/0000_csr-certbot.pem;
    ssl_certificate_key /etc/nginx/ssl/0000_key-certbot.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    # include /etc/nginx/snippets/ssl.conf;

# The internal IP of the VM that hosts your Apache config
    set $upstream 192.168.0.104:2045/;

    location / {
        # proxy_pass_header Authorization;
        proxy_pass http://$upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forward-Proto $scheme; #X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        # proxy_set_header Connection "";
        # proxy_buffering off;
        # client_max_body_size 0;
        # proxy_read_timeout 36000s;
        proxy_redirect http://$upstream https://boards.epochgames.co.uk/;
    }
}

```

When I run `nginx -t` I receive the following:  
`nginx: [emerg] PEM_read_bio_X509_AUX("/etc/nginx/ssl/0000_csr-certbot.pem") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: TRUSTED CERTIFICATE) nginx: configuration file /etc/nginx/nginx.conf test failed`

I don’t think I’m generating the Key/Cert pair properly. @JuergenAuer would you mind explaining how I would go about generating a proper Let’s Encrypt Key/Cert pair? And would I do it on the **Discourse VM** _or_ on the **Nginx VM**?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 15, 2019, 7:43am UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/8 "2019-05-15T07:43:05Z")

</div>

> [@naupe1](#):
>
> I don’t think I’m generating the Key/Cert pair properly.

You have used

> [@naupe1](#):
>
> **I ran this command:** Ran `letsencrypt certonly`

Checking the link you have installed "Letsencrypt".

```nohighlight
sudo apt install letsencrypt -y

```

That's an old version, letsencrypt is renamed to Certbot.

[https://certbot.eff.org/docs/using.html](https://certbot.eff.org/docs/using.html)

Certbot creates the key pairs automatic.

---

<div class="post-metadata">

**Author:** ![Marcovl](https://avatars.discourse-cdn.com/v4/letter/m/e274bd/32.png) [@Marcovl](https://community.letsencrypt.org/u/Marcovl)\
**Post date:** [May 15, 2019, 3:56pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/9 "2019-05-15T15:56:58Z")

</div>

> [@naupe1](#):
>
> ssl\_certificate /etc/nginx/ssl/0000\_csr-certbot.pem;

Isn't that the certificate signing request instead of the certificate?

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 16, 2019, 3:00am UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/10 "2019-05-16T03:00:49Z")

</div>

**UPDATE:** I looked through some old notes of when I got Discourse working on a previous server (although Nginx was on that same server). [I followed Step 3 of this guide for generating the Let's Encrypt Key/Cert pair.](https://www.digitalocean.com/community/tutorials/how-to-install-discourse-behind-nginx-on-ubuntu-14-04) Here is my Nginx conf file:

```
server {
    listen 80; listen [::]:80;
    server_name board.epochgames.co.uk;

    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    return 301 https://$host$request_uri;
}

server {
    # The IP that you forwarded in your router (nginx proxy)
    listen 443 ssl http2; listen [::]:443 ssl http2;

    # Make site accessible from http://localhost/
    server_name board.epochgames.co.uk;
    root /home/lighttpd/http;

    # SSL config
    # ssl on;
    ssl_certificate /etc/nginx/ssl/fullchain1.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey1.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    # include /etc/nginx/snippets/ssl.conf;

# The internal IP of the VM that hosts your Apache config
    set $upstream board.epochgames.co.uk;

    location / {
        # proxy_pass_header Authorization;
        proxy_pass http://$upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forward-Proto $scheme; #X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        # proxy_set_header Connection "";
        # proxy_buffering off;
        # client_max_body_size 0;
        proxy_read_timeout 90; #36000s;
        proxy_redirect http://$upstream https://board.epochgames.co.uk;
    }
}

```

And here are the results after restarting Nginx:

| **Domain Name** | **What Happens?** |
| --- | --- |
| [http://board.epochgames.co.uk/](http://board.epochgames.co.uk/) | Redirects to [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/) |
| [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/) | “ **Apache2 Ubuntu Default Page**" It's identical to [**THIS**](https://annex.exploratorium.edu/) page. |
| [http://board.epochgames.co.uk:2045](http://board.epochgames.co.uk:2045) | “ **Congratulations, you installed Discourse!** ” (the message I expect to see) |
| [https://board.epochgames.co.uk:2045](https://board.epochgames.co.uk:2045) | “ **Secure Connection Failed:** An error occurred during a connection to [board.epochgames.co.uk:2045](http://board.epochgames.co.uk:2045). SSL received a record that exceeded the maximum permissible length. Error code: SSL\_ERROR\_RX\_RECORD\_TOO\_LONG” |
| Let me make this clear: **Apache is _not_ installed on either the Nginx VM _nor_ the Discourse VM!** Ran an `apt purge apache` on both and the "apache" package was _not_ found! | |

So only difference now is [https://board.epochgames.co.uk/](https://board.epochgames.co.uk/). I remember running into the Apache Default Page before in a previous install of Discourse, but can't remember what fixed it. Any ideas?

> [@JuergenAuer](#):
>
> That’s an old version, letsencrypt is renamed to Certbot.  
> ...  
> Certbot creates the key pairs automatic.

Thanks for the link @JuergenAuer, but I don't believe this site is very straight-forward. [So I sought out THIS guide to explain cerbot installation](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04) and went through the following steps:

```
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx
sudo vim /etc/nginx/sites-available/default

```

Added [boards.epochgames.co.uk](http://boards.epochgames.co.uk) to the `default` file. `nginx -t` brought up an error about port 80 already being called, so I commented out `server { listen 80; ... }` section in the [board.epochgames.co.uk](http://board.epochgames.co.uk) Nginx conf file. Now `nginx -t` reports no errors.

So _now_ I ran `certbot --nginx`, where I "reinstalled" the existing certificate for [board.epochgames.co.uk](http://board.epochgames.co.uk) (and chose the `Redirect` option). Got the `Congratulations! You have successfully enabled https://board.epochgames.co.uk` message, restarted Nginx and tried out the site URLs again ... **same results as before certbot install.**

I don't think its the keys/certs anymore? I'm not really sure what to try next. I'm tempted to try installing Nginx straight to the Discourse VM itself and running through the Let's Encrypt key/cert process on that server, see if that does any good. Any ideas?

---

<div class="post-metadata">

**Author:** ![naupe1](https://avatars.discourse-cdn.com/v4/letter/n/c68b51/32.png) [@naupe1](https://community.letsencrypt.org/u/naupe1)\
**Post date:** [May 25, 2019, 1:40pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/11 "2019-05-25T13:40:46Z")

</div>

Bump. No one has any other ideas for me to try!?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 25, 2019, 2:51pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/12 "2019-05-25T14:51:49Z")

</div>

What’s the current problem.

Both domains (boards and board - [https://check-your-website.server-daten.de/?q=board.epochgames.co.uk](https://check-your-website.server-daten.de/?q=board.epochgames.co.uk) ) don’t have ip addresses

| Host | T | IP-Address | is auth. | ∑ Queries | ∑ Timeout |
| --- | --- | --- | --- | --- | --- |
| [board.epochgames.co.uk](http://board.epochgames.co.uk) | | Name Error | yes | 1 | 0 |
| [www.board.epochgames.co.uk](http://www.board.epochgames.co.uk) | | Name Error | yes | 1 | 0 |

But that domain has two new certificates:

| CertSpotter-Id | Issuer | not before | not after | Domain names | LE-Duplicate | next LE |
| --- | --- | --- | --- | --- | --- | --- |
| [918361386](https://check-your-website.server-daten.de/queries/q_get_certificatefile/certfile-certspotter-918361386.pem?certspotter_id=918361386) | CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US | 2019-05-18 08:59:35 | 2019-08-16 08:59:35 | [board.epochgames.co.uk](http://board.epochgames.co.uk) | | |
| 1 entries | | | | | | |
| [912558660](https://check-your-website.server-daten.de/queries/q_get_certificatefile/certfile-certspotter-912558660.pem?certspotter_id=912558660) | CN=Let’s Encrypt Authority X3, O=Let’s Encrypt, C=US | 2019-05-15 03:05:17 | 2019-08-13 03:05:17 | [board.epochgames.co.uk](http://board.epochgames.co.uk) | | |
| 1 entries | | | | | | |

So you should have these two certificates and use one.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 24, 2019, 2:51pm UTC](https://community.letsencrypt.org/t/secure-connection-failed-error-when-trying-to-connect-to-https/93564/13 "2019-06-24T14:51:57Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.