SSL_do_handshake() failed (SSL: error:0A00006C:SSL routines::bad key share) while SSL handshaking

[kartagis]

@rg305

It seems like something has gone wrong with the fastcgi.
As a test, I would try disabling that.

How do I disable fcgi with nginx?

[kartagis]

@rg305

My bet is that this is failing:

fastcgi_pass unix:/run/php-fpm/www.sock;

I just checked, it exists.

[rg305]

@kartagis

it exists.

But is it working?

@kartagis

How do I disable fcgi with nginx?

A question for an nginx forum.

[kartagis]

@rg305

But is it working?

How do I check that?

[rg305]

Sounds like a question for an nginx forum.

[MikeMcQ]

@kartagis

# configuration file /etc/nginx/conf.d/iskillihikayeler.net.conf:
server {
  server_name www.iskillihikayeler.net;
  root /home/iskillihikayeler.net/public_html/drupal/web;
  error_log /var/log/nginx/iskillihikayeler.net-error.log;
  access_log /var/log/nginx/iskillihikayeler.net-access.log;
  location / {
    index index.php;
    try_files $uri /index.php?$query_string;
  }

You could try adding the below location right below the location / shown above and just before your location for php/fastcgi

location /test4 {
   return 418;
}

Restart nginx and we can try connecting with

curl -i https://www.iskillihikayeler.net/test4

It should get a 418 response instead of 500. It would help narrow the problem

[kartagis]

@MikeMcQ

You could try adding the below location right below the location / shown above and just before your location for php/fastcgi

location /test4 {
   return 418;
}

Restart nginx and we can try connecting with

curl -i https://www.iskillihikayeler.net/test4

It should get a 418 response instead of 500. It would help narrow the problem

I indeed got back 418. Does that mean the problem is in / block?

[MikeMcQ]

@kartagis

I indeed got back 418. Does that mean the problem is ...

Yes, it shows the cert config for that domain is working normally. The problem is requests using URI for a .php fail with a 500.

Something looks wrong with php and/or fastcgi generally and nothing related to Let's Encrypt certs.

[kartagis]

Weird. I commented out fastcgi_pass line and when I refreshed, the contents of index.php was downloaded with the extension .dms.

[rg305]

@kartagis

I commented out fastcgi_pass line

Change the entire location:

@kartagis

location ~ \.php$ {

[kartagis]

@rg305

Change the entire location:

location ~ \.php$ {

If you mean that line should be in the .php$ location, it already is.

[rg305]

I mean [as a test] change that location to something else:
location ~ \.php$ {
location ~ \.xxx$ {

[kartagis]

I did, now when I do curl, I get the php file but on the browser I get whitescreen.

[rg305]

I would put pack that php location.
And also add a location to handle the ACME challenge requests in the HTTP vhost:
[something simple for testing, like below]

location /.well-known/acme-challege/ {
    root /some/new/unique/ACME/path; # <<< you need to create this new path
    error_log /var/log/nginx/ACME-error.log;
    access_log /var/log/nginx/ACME-access.log;
}