Nginx returns 400 on https requests

Question

I've set up nginx with letsencrypt to work with https. My /etc/nginx/conf.d/app.conf is the following (no other server directives are configured):

server {

        location /.well-known/acme-challenge/ {
                autoindex on;
                root /var/www/certbot/;
        }

        location / {
                return 301 https://$host$request_uri;
        }

        server_name example.com;
        listen 80;
}

server {
        listen 443;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        server_name example.com;

        location /.well-known/acme-challenge/ {
                root /var/www/certbot;
        }

        location /static/ {
                gzip on;
                gzip_static on;
                gzip_types text/plain text/css text/javascript application/javascript;
                gzip_disable "msie6";

                alias /static/;
                autoindex off;
        }

        # many other locations
}

When I try to open https://example.com, nginx returns 400, these are the logs:

mysite_nginx | 1.1.1.1 - - [04/Apr/2019:16:43:52 +0000] "\x16\x03\x01\x00\xC6\x01\x00\x00\xC2\x03\x03\x97\x08D\x08\x87\x5Cg\xDB\x85\x8Ch\x16\xC9\x1E\x01\xDB\x9F\x12\x04\x91e\xB3P]4]\xFE\xEF\xE5^\xB7\x07\x00\x00\x1C" 400 157 "-" "-" "-"
mysite_nginx | 1.1.1.1 - - [04/Apr/2019:16:43:52 +0000] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03s\xC0\xBDWM\xC4n\x12\xD6\x1BQ\xCF\x0C\xDD\x93\xE6\x8D\x1B5YV\xBB\x9D\xB9\x8A,\x02\xC1nS\xE1\x15 y." 400 157 "-" "-" "-"
mysite_nginx | 1.1.1.1 - - [04/Apr/2019:16:43:52 +0000] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03wa\x13\x96D\xCB)f\x9B\xED\x1B\xA9\xFD\xA8\xCAU\x1A\xDA\xA0" 400 157 "-" "-" "-"
mysite_nginx | 1.1.1.1 - - [04/Apr/2019:16:43:52 +0000] "\x16\x03\x01\x00\xC6\x01\x00\x00\xC2\x03\x03\x96]\xEC\x1F\x077\xCF\xE5N]k\x86\xCF\xEF\x13\xF0\xFC\xCBL\xFD\x06\xF5\x10|\xD8\x9C\xC0\xE7-\xD4(\xBF\x00\x00\x1C\xBA\xBA\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x13\xC0\x14\x00\x9C\x00\x9D\x00/\x005\x00" 400 157 "-" "-" "-"

I've done some research and found that this could happen if https request is made to http endpoint, but I can't figure out what's wrong with my configuration. How to fix it?

UPD nginx is running inside the docker container, docker-compose.yml is of version 2.4, nginx service definition:

nginx:
    image: nginx:1.15.9-alpine
    volumes:
      - ./configs/nginx:/etc/nginx/conf.d
      - ./configs/nginx.proxy_params:/etc/nginx/proxy_params
      - ./volumes/certbot/conf:/etc/letsencrypt
      - ./volumes/certbot/www:/var/www/certbot
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
    ports:
      - "80:80"
      - "443:443"
    restart: on-failure

options-ssl-nginx.conf and ssl-dhparams.pem are taken from the official certbot repo.

I checked that the files fullchain.pem and privacy.pem exist in /etc/letsencrypt/live/example.com.

You omitted some important information that you need to include, in particular: This appears to be inside a Docker container. You need to show the container definition, docker-compose.yml, and any other relevant information. — Michael Hampton, Apr 04 '19 at 16:56
You haven't enabled SSL for the 443 port. Try: `listen 443 ssl;` — Richard Smith, Apr 04 '19 at 17:08
@RichardSmith, omg, my bad. Post this as answer, please, so I can accept it — Nikrom, Apr 04 '19 at 17:14

score 9 · Accepted Answer · answered Apr 04 '19 at 17:21

9

You need to enable SSL on the 443 port. See this document for details.

For example:

listen 443 ssl;

answered Apr 04 '19 at 17:21

Richard Smith

12,834
2
21
29

Nginx returns 400 on https requests

1 Answers1