# SSL error blocks access from certain browsers/networks using apache2

**URL:** <https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203>\
**Category:** Help\
**Created:** [February 17, 2022, 1:00am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203 "2022-02-17T01:00:29Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 1:00am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/1 "2022-02-17T01:00:29Z")

</div>

Can someone help me figure out why there is a SSL error on my website?  
I'll do my best to explain. Certain people have told me that [mysite](https://pastlife.works/) is inaccessible. I cant reproduce it because from my end (home network and cell network) it loads fine. I have tested it in firefox, chrome, and brave from all my devices. I'm sorry but I cant print out the error because no one has helped me by sending a screen shot of what the error says.

## My apache2 .conf files and .htaccess file is posted here: [https://pastebin.com/riVMcwYN](https://pastebin.com/riVMcwYN) The first section in the paste is actually the regular .conf, not the le-ssl.conf. sorry about that Thank you so much for your time and efforts.

My domain is: [https://pastlife.works](https://pastlife.works)

My web server is : apache2 2.4.38-3+deb10u7 amd64

The operating system is: Debian 10 4.19.208-1 (2021-09-29) x86\_64 GNU/Linux

My hosting provider is: [Linode.com](http://Linode.com)

I can login to a root shell?: yes

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):

certbot/oldstable,now 0.31.0-1+deb10u1 all [installed]  
python-certbot-apache/oldstable,now 0.31.0-1 all [installed]  
python3-certbot/oldstable,now 0.31.0-1+deb10u1 all [installed,automatic]  
python3-certbot-apache/oldstable,now 0.31.0-1 all [installed,automatic]

**update** Someone did report they get an error with curl:  
(35) error:1408F10B:SSL routines:ssl3\_get\_record:wrong version number

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:25am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/2 "2022-02-17T01:25:48Z")

</div>

Hi @pastlife and welcome to the LE community forum 🙂

The problem seems to be only with IPv4:

```nohighlight
curl -Ii4 https://www.pastlife.works
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

curl -Ii6 https://www.pastlife.works
HTTP/1.1 200 OK
Date: Thu, 17 Feb 2022 01:24:48 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Mon, 07 Feb 2022 17:34:34 GMT
ETag: "11c6-5d7710392990f"
Accept-Ranges: bytes
Content-Length: 4550
Vary: Accept-Encoding
Content-Type: text/html

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:28am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/3 "2022-02-17T01:28:22Z")

</div>

You can start to unravel the mystery with the output of:  
`apachectl -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:29am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/4 "2022-02-17T01:29:48Z")

</div>

More information:

```nohighlight
curl -Ii4 https://www.pastlife.works/
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

curl -Ii4 http://www.pastlife.works:443/
HTTP/1.1 200 OK
Date: Thu, 17 Feb 2022 01:29:02 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Mon, 07 Feb 2022 17:34:34 GMT
ETag: "11c6-5d7710392990f"
Accept-Ranges: bytes
Content-Length: 4550
Vary: Accept-Encoding
Content-Type: text/html

```

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 1:31am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/5 "2022-02-17T01:31:20Z")

</div>

Thank you for the reply and for pointing this out.  
So is this a client side problem with their browsers or operating systems or is it something that I can change in my .htaccess file or config files that would force my server to use IPv6?

Here is the output of `apachectl -t -D DUMP_VHOSTS`

```nohighlight
VirtualHost configuration:
45.79.80.227:80 45.79.80.227 (/etc/apache2/sites-enabled/lexrex.xyz.conf:1)
45.79.80.227:443 45.79.80.227 (/etc/apache2/sites-enabled/lexrex.xyz.conf:12)
*:443 is a NameVirtualHost
         default server lexrex.xyz (/etc/apache2/sites-enabled/lexrex.xyz-le-ssl.conf:2)
         port 443 namevhost lexrex.xyz (/etc/apache2/sites-enabled/lexrex.xyz-le-ssl.conf:2)
                 alias www.lexrex.xyz
         port 443 namevhost pastlife.works (/etc/apache2/sites-enabled/pastlife.works-le-ssl.conf:2)
                 alias www.pastlife.works
         port 443 namevhost starseedgrowers.org (/etc/apache2/sites-enabled/starseedgrowers.org-le-ssl.conf:2)
                 alias www.starseedgrowers.org
*:80 is a NameVirtualHost
         default server lexrex.xyz (/etc/apache2/sites-enabled/lexrex.xyz.conf:19)
         port 80 namevhost lexrex.xyz (/etc/apache2/sites-enabled/lexrex.xyz.conf:19)
                 alias www.lexrex.xyz
         port 80 namevhost pastlife.works (/etc/apache2/sites-enabled/pastlife.works.conf:1)
                 alias www.pastlife.works
         port 80 namevhost starseedgrowers.org (/etc/apache2/sites-enabled/starseedgrowers.org.conf:1)
                 alias www.starseedgrowers.org

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:33am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/6 "2022-02-17T01:33:44Z")

</div>

> [@pastlife](#):
>
> So is this a client side problem

No, server side problem.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:39am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/8 "2022-02-17T01:39:44Z")

</div>

Please show the outputs of:

`ifconfig | grep -Ei 'add|inet'`  
`sudo netstat -pant | grep -i listen`  
`curl -4 ifconfig.co`  
`curl -6 ifconfig.co`  
`cat /etc/apache2/sites-enabled/pastlife.works-le-ssl.conf`  
`grep -Ri listen /etc/apache2`

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 1:47am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/9 "2022-02-17T01:47:28Z")

</div>

`-bash: ifconfig: command not found`

**sudo netstat -pant | grep -i listen**

```nohighlight
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 480/sshd            
tcp 0 0 0.0.0.0:8767 0.0.0.0:* LISTEN 490/ravend          
tcp6 0 0 :::80 :::* LISTEN 492/apache2         
tcp6 0 0 :::22 :::* LISTEN 480/sshd            
tcp6 0 0 :::443 :::* LISTEN 492/apache2         
tcp6 0 0 :::65532 :::* LISTEN 560/murmurd         
tcp6 0 0 :::8766 :::* LISTEN 490/ravend          
tcp6 0 0 :::8767 :::* LISTEN 490/ravend 

```

**curl -4 [ifconfig.co](http://ifconfig.co)**  
45.79.80.227

**curl -6 [ifconfig.co](http://ifconfig.co)**  
2600:3c01::f03c:92ff:fef4:a0df

**cat /etc/apache2/sites-enabled/pastlife.works-le-ssl.conf**

```nohighlight
<IfModule mod_ssl.c>
<VirtualHost *:443>

        ServerAdmin contact@pastlife.works
        ServerName pastlife.works
        ServerAlias www.pastlife.works
        DocumentRoot /var/www/pastlife.works

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

	SSLCertificateFile /etc/letsencrypt/live/pastlife.works/fullchain.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/pastlife.works/privkey.pem
	Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>
</IfModule>

```

**grep -Ri listen /etc/apache2**

```nohighlight
/etc/apache2/ports.conf:Listen 80
/etc/apache2/ports.conf:	Listen 443
/etc/apache2/ports.conf:	Listen 443
/etc/apache2/apache2.conf:# supposed to determine listening ports for incoming connections which can be
/etc/apache2/apache2.conf:# Include list of ports to listen on

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 1:52am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/10 "2022-02-17T01:52:10Z")

</div>

hmm...  
Very interesting.

What shows:  
`openssl version`

Is there any IPS, or layer 7 firewall, involved?

Please show the output of:  
`ps -ef | grep -i apache | grep -v grep`

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 1:57am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/11 "2022-02-17T01:57:30Z")

</div>

OpenSSL 1.1.1d 10 Sep 2019

Not sure about IPS. I am using ufw with standard rules allowing http and https. I also have ports open for my mumble server, which is on the mumble public servers list also using the SSL certificate, and port open for the ravencoin node

I also have fail2ban running

```nohighlight
root 492 1 0 15:51 ? 00:00:00 /usr/sbin/apache2 -k start
www-data 498 492 0 15:51 ? 00:00:01 /usr/sbin/apache2 -k start
www-data 499 492 0 15:51 ? 00:00:00 /usr/sbin/apache2 -k start

```

Thanks for your help

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 2:15am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/12 "2022-02-17T02:15:16Z")

</div>

Have you restarted the server?  
I don't see anything obviously wrong.  
[running out of options...]

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 17, 2022, 2:18am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/13 "2022-02-17T02:18:13Z")

</div>

Is it possible Apache is only listening on ipv6?

Judging from the netstat output, I mean.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 2:22am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/14 "2022-02-17T02:22:21Z")

</div>

No, when it shows `tcp6`, tcp4 is implied.  
Notice how IPv4:80 nor IPv4:443 aren't listed, and yet it works for HTTP (on port 443):

```nohighlight
curl -Ii4 http://www.pastlife.works:443/
HTTP/1.1 200 OK
Date: Thu, 17 Feb 2022 01:29:02 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Mon, 07 Feb 2022 17:34:34 GMT
ETag: "11c6-5d7710392990f"
Accept-Ranges: bytes
Content-Length: 4550
Vary: Accept-Encoding
Content-Type: text/html

```

It's like "`SSLEngine on`" is only being enabled for IPv6 (not for IPv4).

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 2:24am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/15 "2022-02-17T02:24:28Z")

</div>

I'm also getting help from Linode.

> **[Can I get some help with SSL errors from certain browsers? | Linode Questions](https://www.linode.com/community/questions/22482/can-i-get-some-help-with-ssl-errors-from-certain-browsers#answer-79745)**
>
> OK I'll do my best to explain. Certain people have told me that \[mysite\](https://pastlife.works) is inaccessible due to an SSL error, but I cant confirm this because from my end (from home netw...

Just rebooted. I noticed my `/etc/hosts` is a bit weird.

```nohighlight
127.0.0.1	localhost
127.0.1.1	genesis.pastlife.works genesis
	
45.79.80.227	pastlife.works
	
45.79.80.227	www.pastlife.works
	
45.79.80.227	starseedgrowers.org
	
45.79.80.227	www.starseedgrowers.org

# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

```

not sure if it's supposed to look like that.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 17, 2022, 2:26am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/16 "2022-02-17T02:26:18Z")

</div>

> [@pastlife](#):
>
> ```nohighlight
> 45.79.80.227:80 45.79.80.227 (/etc/apache2/sites-enabled/lexrex.xyz.conf:1)
> 45.79.80.227:443 45.79.80.227 (/etc/apache2/sites-enabled/lexrex.xyz.conf:12)
> 
> ```

There is some ipv4-exclusive config.

Can you show us that file?

> [@pastlife](#):
>
> not sure if it's supposed to look like that.

it looks fine. (it can probably do without, bit some software needs those lines.)

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 2:32am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/17 "2022-02-17T02:32:21Z")

</div>

Wow I think you may have found the issue but IDK why I did this or what to do about it. 😅

```nohighlight
<VirtualHost 45.79.80.227:80>
	ServerName 45.79.80.227
	ServerAlias pastlife.works
	DocumentRoot /var/www/pastlife.works
RewriteEngine on
RewriteCond %{SERVER_NAME} =pastlife.works [OR]
RewriteCond %{SERVER_NAME} =www.pastlife.works
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

<VirtualHost 45.79.80.227:443>
        ServerName 45.79.80.227
        ServerAlias pastlife.works
        DocumentRoot /var/www/pastlife.works
</VirtualHost>

<VirtualHost *:80>
        ServerAdmin contact@pastlife.works
        ServerName lexrex.xyz
        ServerAlias www.lexrex.xyz
        DocumentRoot /var/www/lexrex.xyz
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =lexrex.xyz [OR]
RewriteCond %{SERVER_NAME} =www.lexrex.xyz
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

```

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 2:33am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/18 "2022-02-17T02:33:33Z")

</div>

> [@pastlife](#):
>
> ```nohighlight
> <VirtualHost 45.79.80.227:443>
> ServerName 45.79.80.227
> ServerAlias pastlife.works
> DocumentRoot /var/www/pastlife.works
> </VirtualHost>
> 
> ```

Delete that whole section.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [February 17, 2022, 2:35am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/19 "2022-02-17T02:35:15Z")

</div>

Also delete the other section with the full IP address. Merge its content in the `<VirtualHost *:80>` section if necessary.

---

<div class="post-metadata">

**Author:** ![pastlife](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pastlife/32/82303_2.png) [@pastlife](https://community.letsencrypt.org/u/pastlife)\
**Post date:** [February 17, 2022, 2:41am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/20 "2022-02-17T02:41:59Z")

</div>

I think you both helped me fix it, cant tell though because it always "worked" on my end:  
[https://www.ssllabs.com/ssltest/analyze.html?d=pastlife.works](https://www.ssllabs.com/ssltest/analyze.html?d=pastlife.works)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 17, 2022, 2:49am UTC](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203/21 "2022-02-17T02:49:11Z")

</div>

> [@pastlife](#):
>
> it always "worked" on my end

IPv6 always worked.

[Next page](https://community.letsencrypt.org/t/ssl-error-blocks-access-from-certain-browsers-networks-using-apache2/172203.md?page=2)