Sorry I'm not a sys admin.
I'm trying to install my SSL Certificate for encrypt purposes and to use Nginx as a frontend of my Tomcat Alfresco application.
I just can't reach my domain with HTTPS as desired, I receive these messages on each browser that I attempt to connect
Chrome:
SSL connection error
ERRSSLPROTOCOL_ERROR Hide details Unable to make a secure connection to the server. This may be a problem with the server, or it may be requiring a client authentication certificate that you don't have.
FireFox:
An error occurred during a connection to www.example.com. SSL received a >record that exceeded the maximum permissible length. (Error code: >ssl_error_rx_record_too_long) The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
The log files (access and error) at /var/log/nginx are completely empty and here is my nginx.conf file
user www-data;
worker_processes 2;
pid /run/nginx.pid;
events {
worker_connections 1024;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# Logging Settings
##
access_log on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log debug;
##
# Gzip Settings
##
gzip on;
gzip_disable "msie6";
gzip_http_version 1.1;
gzip_comp_level 6;
#gzip_min_length 256;
gzip_buffers 16 8k;
gzip_proxied any;
gzip_types text/xml text/plain application/json text/javascript application/javascript application/x-javascript text/css text/csv text/x-markdown text/x-web-markdown application/atom+xml application/rss+xml application/atomsvc+xml;
#gzip_vary on;
# Set proxy cache path
proxy_cache_path /var/cache/nginx/alfresco levels=1 keys_zone=alfrescocache:256m max_size=512m inactive=1440m;
# Main website Tomcat instance
upstream alfresco {
server localhost:8080;
}
# Sharepoint Alfresco vti module
#upstream sharepoint {
# server localhost:7070;
#}
# Uncomment if you want redirect to https
server {
listen 80 default_server ;
listen [::]:80 default_server ipv6only=on;
server_name example.com www.example.com;
server_name_in_redirect off;
rewrite ^ https://$host$request_uri? permanent;
}
# Default server config. Update servername.
server {
#listen 80 default_server ;
#listen [::]:80 default_server ipv6only=on;
listen 443 default_server ssl;
#listen 443 ssl spdy;
server_name example.com www.example.com;
root /opt/alfresco/www;
index index.html index.htm;
# Redirecto root requests to Share
rewrite ^/$ /share;
ssl on;
ssl_certificate /etc/ssl/example.crt;
ssl_certificate_key /etc/ssl/private/example.key;
ssl_verify_client off;
ssl_session_timeout 15m;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
#ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
# spdy Support, use add_header if you do not use redirection from http to https
#add_header Alternate-Protocol 443:npn-spdy/2;
#spdy_headers_comp 4;
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ /index.html;
# Uncomment to enable naxsi on this location
# include /etc/nginx/naxsi.rules
}
# redirect server error pages to the static page /50x.html
#
error_page 502 503 504 /maintenance.html;
location = /maintenance.html {
root /opt/alfresco/www;
}
# Access to old Alfresco web client. Remove this location if not needed.
location /alfresco {
# Allow for large file uploads
client_max_body_size 0;
# Proxy all the requests to Tomcat
proxy_http_version 1.1;
#proxy_buffering off;
proxy_pass http://alfresco;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Server $host;
}
location /share {
# Allow for large file uploads
client_max_body_size 0;
# Proxy all the requests to Tomcat
proxy_http_version 1.1;
#proxy_buffering off;
proxy_pass http://alfresco;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Server $host;
}
location /share/proxy/alfresco {
# This section is for allowing to rewrite 50x response to 401 on Ajax req.
# This forces Share to reload page, and thus display maintenance page
# Allow for large file uploads
client_max_body_size 0;
# Proxy all the requests to Tomcat
proxy_http_version 1.1;
#proxy_buffering off;
proxy_pass http://alfresco;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Server $host;
proxy_intercept_errors on;
error_page 502 503 504 =401 /maintenance.html;
}
location /share/res/ {
# Proxy all the requests to Tomcat
proxy_http_version 1.1;
proxy_pass http://alfresco;
proxy_set_header Host $http_host;
proxy_cache alfrescocache;
proxy_cache_min_uses 1;
proxy_cache_valid 200 302 1440m;
proxy_cache_valid 404 1m;
proxy_cache_use_stale updating error timeout invalid_header http_500 http_502 http_503 http_504;
}
}
Can anybody help me sort this out? I have 15 days to get this work out or return it and ask the CA for a refund.
Extra info:
Ubuntu 15.04
java version "1.8.0_66"
Tomcat 7
nginx/1.8.0
SSL from GoDaddy
Edit: user@host:/opt/alfresco/www$ ls -la total 20 drwxr-xr-x 2 www-data root 4096 Sep 17 18:21 . drwxr-xr-x 9 alfresco alfresco 4096 Sep 17 19:23 .. -rw-r--r-- 1 www-data root 10563 Sep 17 18:21 maintenance.html
