# Debugging ssl and php-fpm

**URL:** <https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685>\
**Category:** NGINX\
**Created:** [November 24, 2013, 1:55pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685 "2013-11-24T13:55:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\
**Post date:** [November 24, 2013, 1:55pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685/1 "2013-11-24T13:55:15Z")

</div>

Okay, so rule #1 is to never think a server migration will go easy.

As I’ve said in another thread, I’ve been running nginx and php-fpm for  
years on my site. But I’m moving from a CentOS to an Ubuntu server and  
things aren’t going as smooth as they should be.

I’ve got the non-ssl server working just fine. Tested out the SSL pages  
and I’m getting blank pages but I can’t seem to see anything in the logs  
or at least nothing that’s clear to me.

Here’s a snippet of the SSL server:

server {  
server\_name [www.example.com](http://www.example.com);  
listen 443;  
root /usr/share/nginx/html;  
index index.shtml index.php index.html;  
include /etc/nginx/fastcgi\_params;  
error\_log /var/log/nginx/sslerror.log debug;

ssl on;  
ssl\_certificate /etc/nginx/certs/example.pem;  
ssl\_certificate\_key /etc/nginx/certs/example.key;  
ssl\_session\_timeout 5m;  
error\_page 404 /dhe404.shtml;

location / {  
rewrite ^ http://www.example.com$request\_uri? permanent;  
}

location ~ .(shtml|php|inc)$ {  
fastcgi\_pass 127.0.0.1:9000;  
}

location ^~ /rather/ {  
fastcgi\_intercept\_errors on;  
fastcgi\_pass 127.0.0.1:9000;  
fastcgi\_param HTTPS on;  
fastcgi\_index index.shtml;  
auth\_basic “DHENEWS”;  
auth\_basic\_user\_file .htpasswd;  
}

…  
}

So, I’m trying to go a php page under /rather, a page I’ve used  
thousands of times on the old server.

I get prompted for my username and password by the auth. That works, but  
then I get a blank page.

so:

- PHP is working on the non-ssl side
- we’ve got fastcgi\_pass in the locations.

And most importantly…it works on the old server so why am I pulling my  
hair out? 😉 Is there something I’m missing in regards to ssl and  
php-fpm? Here’s the fastcgi\_params:

fastcgi\_param QUERY\_STRING $query\_string;  
fastcgi\_param REQUEST\_METHOD $request\_method;  
fastcgi\_param CONTENT\_TYPE $content\_type;  
fastcgi\_param CONTENT\_LENGTH $content\_length;

fastcgi\_param SCRIPT\_NAME $document\_root$fastcgi\_script\_name;  
fastcgi\_param REQUEST\_URI $request\_uri;  
fastcgi\_param DOCUMENT\_URI $document\_uri;  
fastcgi\_param DOCUMENT\_ROOT $document\_root;  
fastcgi\_param SERVER\_PROTOCOL $server\_protocol;  
fastcgi\_param HTTPS $https if\_not\_empty;

fastcgi\_param GATEWAY\_INTERFACE CGI/1.1;  
fastcgi\_param SERVER\_SOFTWARE nginx/$nginx\_version;

fastcgi\_param REMOTE\_ADDR $remote\_addr;  
fastcgi\_param REMOTE\_PORT $remote\_port;  
fastcgi\_param SERVER\_ADDR $server\_addr;  
fastcgi\_param SERVER\_PORT $server\_port;  
fastcgi\_param SERVER\_NAME $server\_name;  
fastcgi\_param PATH\_TRANSLATED $document\_root$fastcgi\_script\_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect

fastcgi\_param REDIRECT\_STATUS 200;

# cache stuff

fastcgi\_cache MYCACHE;  
fastcgi\_keep\_conn on;  
fastcgi\_cache\_bypass $no\_cache $no\_cache\_dirs;  
fastcgi\_no\_cache $no\_cache $no\_cache\_dirs;  
fastcgi\_cache\_valid 200 301 5m;  
fastcgi\_cache\_valid 302 5m;  
fastcgi\_cache\_valid 404 1m;  
fastcgi\_cache\_use\_stale error timeout invalid\_header updating http\_500;  
fastcgi\_ignore\_headers Cache-Control Expires;  
fastcgi\_cache\_lock on;

Thanks to the list for a fresh pair of eyes.

---

<div class="post-metadata">

**Author:** ![peterpiper](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3e96dc/32.png) [@peterpiper](https://www.ruby-forum.com/u/peterpiper)\
**Post date:** [November 24, 2013, 3:43pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685/2 "2013-11-24T15:43:54Z")

</div>

On Sun, Nov 24, 2013 at 07:54:56AM -0500, Ian E. wrote:

Hi there,

> location ^~ /rather/ {  
> fastcgi\_intercept\_errors on;  
> fastcgi\_pass 127.0.0.1:9000;  
> fastcgi\_param HTTPS on;

Does it work if you remove that line? It looks unnecessary to me. And  
it breaks your config.

> fastcgi\_index index.shtml;  
> auth\_basic “DHENEWS”;  
> auth\_basic\_user\_file .htpasswd;  
> }

> And most importantly…it works on the old server so why am I pulling my  
> hair out? 😉

What does “diff” say about the config on the old server and the config  
on the new server?

> Is there something I’m missing in regards to ssl and  
> php-fpm? Here’s the fastcgi\_params:

fastcgi\_params is included at server level, not within /rather/. Only  
some parts of its contents are inherited into /rather/.

## f

Francis D. removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![peterpiper](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3e96dc/32.png) [@peterpiper](https://www.ruby-forum.com/u/peterpiper)\
**Post date:** [November 24, 2013, 3:52pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685/3 "2013-11-24T15:52:40Z")

</div>

Hello,

On Sun, Nov 24, 2013 at 3:43 PM, Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> it breaks your config.

## ​Sorry to interrupt, but could you explain a little bit more about what breaks the config?​

_B. R._

---

<div class="post-metadata">

**Author:** ![peterpiper](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3e96dc/32.png) [@peterpiper](https://www.ruby-forum.com/u/peterpiper)\
**Post date:** [November 24, 2013, 4:17pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685/4 "2013-11-24T16:17:12Z")

</div>

On 24/11/2013 9:43 AM, Francis D. wrote:

> What does “diff” say about the config on the old server and the config  
> on the new server?

As I moved to a new server, I split everytng from one file to the whole  
sites-available format so I’d have to recombine everything. However…

> fastcgi\_params is included at server level, not within /rather/. Only  
> some parts of its contents are inherited into /rather/.

Tossing the params into /rather did the trick.

Many, many thanks.

---

<div class="post-metadata">

**Author:** ![peterpiper](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/3e96dc/32.png) [@peterpiper](https://www.ruby-forum.com/u/peterpiper)\
**Post date:** [November 24, 2013, 5:10pm UTC](https://www.ruby-forum.com/t/debugging-ssl-and-php-fpm/237685/5 "2013-11-24T17:10:23Z")

</div>

On Sun, Nov 24, 2013 at 03:51:21PM +0100, B.R. wrote:

> On Sun, Nov 24, 2013 at 3:43 PM, Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > On Sun, Nov 24, 2013 at 07:54:56AM -0500, Ian E. wrote:

Hi there,

> > > location ^~ /rather/ {  
> > > fastcgi\_intercept\_errors on;  
> > > fastcgi\_pass 127.0.0.1:9000;  
> > > fastcgi\_param HTTPS on;
> > 
> > Does it work if you remove that line? It looks unnecessary to me. And  
> > it breaks your config.
> 
> Sorry to interrupt, but could you explain a little bit more about what  
> breaks the config?

The upstream of fastcgi\_pass usually requires a “fastcgi\_param  
SCRIPT\_FILENAME” to be set.

Directive inheritance rules mean that this “fastcgi\_param” directive is  
the only one that applies in this location.

## f

Francis D. removed\_email\_address@domain.invalid