SSL/TLS connection failed

Help
23

I have downloaded certificate file 5102836967.crt from url

#mv 5102836967.crt /etc/ssl/certs/ca.crt
#vi /etc/apache2/sites-available/default-ssl.conf

Change the CA into

SSLCACertificatePath /etc/ssl/certs/
SSLCACertificateFile /etc/ssl/certs/ca.crt

Restart apache2:
#service apache2 restart
And it doesn't work.

$ curl -Iki https://www.mydomain.top:8443/list_score.php
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.mydomain.top:8443
24

Unexpected.
The leaf cert should not be used this way.

I already spoke about these two entries:

OpenSSL 1.0.1f went out of support in December 2016; but it did support TSv1.2.
You should upgrade it if possible and
Please show file:
/etc/apache2/mods-enabled/ssl.conf

And most importantly...
Is your site behind the Great Firewall of China?

2 Likes
25

cat /etc/apache2/mods-enabled/ssl.conf

<IfModule mod_ssl.c>
        SSLRandomSeed startup builtin
        SSLRandomSeed startup file:/dev/urandom 512
        SSLRandomSeed connect builtin
        SSLRandomSeed connect file:/dev/urandom 512

        AddType application/x-x509-ca-cert .crt
        AddType application/x-pkcs7-crl .crl
        SSLPassPhraseDialog exec:/usr/share/apache2/ask-for-passphrase
        SSLSessionCache         shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
        SSLSessionCacheTimeout  300
        SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
        SSLProtocol all

</IfModule>

And my site is behind the Great Firewall of China.

2 Likes
26

Then you may need to speak with whomever about https access to your site through that firewall.

2 Likes
27

:cry:
It's a problem.

2 Likes
28

So it seems.

Can you use a host on the other side of that firewall?

[and thanks to @JimPas for pointing out this possible firewall problem]

2 Likes
29

No other host.

2 Likes
30

:slight_smile:
Then I don't think we can fix this problem for you.

2 Likes
31

So sad.Thanks all!

3 Likes
32

A post was split to a new topic: My site is continuously unreachable