# Nginx SSL\_do\_handshake() failed **URL:** \ **Category:** NGINX\ **Created:** [December 2, 2015, 9:00am UTC](https://www.ruby-forum.com/t/nginx-ssl-do-handshake-failed/243535 "2015-12-02T09:00:54Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [December 2, 2015, 9:00am UTC](https://www.ruby-forum.com/t/nginx-ssl-do-handshake-failed/243535/1 "2015-12-02T09:00:54Z")
it’s the first time I configure an SSL certificate on my development machine (I’m no sysadmin - I need SSL to work with facebook). I decided to go with ngingx proxying a ruby sinatra application, nothing fancy. This is the error I get when Facebook tries to connect to my HTTP server. AFAIK nginx is the culprit here: 2015/11/26 15:42:03 [info] 42872#0: \*3 SSL\_do\_handshake() failed (SSL: error:14094418:SSL routines:ssl3\_read\_bytes:tlsv1 alert unknown ca:SSL alert number 48) while SSL handshaking, client: 31.13.113.70, server: 0.0.0.0:4567 This is what I did: Downloaded the cert (a .key, a .crt and a .csr) from RapidSSL Downloaded the trusted cert from RapidSSL ([https://knowledge.rapidssl.com/library/VERISIGN/ALL\_OTHER/RapidSSL%20Intermediate/RapidSSL\_CA\_bundle.pem](https://knowledge.rapidssl.com/library/VERISIGN/ALL_OTHER/RapidSSL%20Intermediate/RapidSSL_CA_bundle.pem)) and saved locally under /etc/ssl/cert/ Installed locally nginx and configured like this: [gist:f97adc4194b08ea355c8 · GitHub](https://gist.github.com/ngw/f97adc4194b08ea355c8) Restarted both nginx and puma respectively on port 4567 and 8080 Went to [https://sandbox.thing.it](https://sandbox.thing.it), the app responded as expected, the connection was encrypted and the certificate appears to be the correct one. Went to Facebook and attempted to register a new page subscription ([Meta Webhooks - Documentation - Meta for Developers](https://developers.facebook.com/docs/graph-api/webhooks/v2.2)). Had the error reported on the top (SSL\_do\_handshake() failed) when Facebook attempted to validate my callback url Any suggestion? Thanks for your time, ngw ---
**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\ **Post date:** [December 2, 2015, 9:09am UTC](https://www.ruby-forum.com/t/nginx-ssl-do-handshake-failed/243535/2 "2015-12-02T09:09:41Z")
Hello! On Fri, Nov 27, 2015 at 04:54:29PM +0100, Nicholas W. wrote: > Installed locally nginx and configured like this: > [gist:f97adc4194b08ea355c8 · GitHub](https://gist.github.com/ngw/f97adc4194b08ea355c8) > Restarted both nginx and puma respectively on port 4567 and 8080 > > Went to [https://sandbox.thing.it](https://sandbox.thing.it), the app responded as expected, the connection > was encrypted and the certificate appears to be the correct one. > > Went to Facebook and attempted to register a new page subscription > ([https://developers.facebook.com/docs/graph-api/webhooks/v2.2](https://developers.facebook.com/docs/graph-api/webhooks/v2.2)). Had the error > reported on the top (SSL\_do\_handshake() failed) when Facebook attempted to > validate my callback url > > Any suggestion? Make sure to properly configure certificate chains, see > **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#chains)** > > To configure an HTTPS server, the ssl parameter must be enabled on listening sockets in the server block, and the locations of the server certificate and private key files should be specified: for details. Note well that if you have no experience with SSL configuration, it’s a good idea to avoid configuring anything but ssl\_certificate and ssl\_certificate\_key (and ssl\_session\_cache for performance reasons). That is, remove (or comment out) all other ssl\_\* directives in your configuration (including ssl\_stapling, ssl\_stapling\_verify, ssl\_prefer\_server\_ciphers, ssl\_protocols, ssl\_ciphers) unless you’ll get it working. You can re-add these directives later if needed. The error you are seeing is likely unrelated, but it’s generally better approach anyway. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\ **Post date:** [December 2, 2015, 9:24am UTC](https://www.ruby-forum.com/t/nginx-ssl-do-handshake-failed/243535/3 "2015-12-02T09:24:18Z")
Hello! On Fri, Nov 27, 2015 at 05:41:23PM +0100, Nicholas W. wrote: > > On 27 Nov 2015, at 17:14, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: […] > > Make sure to properly configure certificate chains, see > > [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#chains) > > for details. > > I’m not entirely sure I understand why I need a certificate > chain. The .crt file is what the provider sent me, that’s what I > use. Should I “chain” the .crt file the provider sent me with > the RapidSSL bundle? This is for testing and development, I > don’t really care about performances, a slow solution is > perfectly fine Certificate chains are needed, because a typical certificate is issued by an intermediate CA, while browsers know only about root CAs. And a web server must supply intermediate CA certificate to a browser (or other client) for the browser to be able to verify that the certificate provided by the web server should be trusted. The link quoted explains how to properly put certs into a certificate file for things to work, and how to validate that the result is correct. Normally it’s as easy as just concatenating your server’s certificate and the bundle provided by your CA. But things may vary depending on CA - some CAs may provide incorrect bundles, or certs in a wrong order within the bundle, or there may be more than one bundle and you’ll have to choose the right one. That is, it’s a good idea to understand what you are doing and verify that the resulting chain returned by your server contains all needed certs in the correct order (see “openssl s\_client …” part of the link). – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Nicholas\_W](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nicholas\_W](https://www.ruby-forum.com/u/Nicholas_W)\ **Post date:** [December 2, 2015, 9:13am UTC](https://www.ruby-forum.com/t/nginx-ssl-do-handshake-failed/243535/4 "2015-12-02T09:13:11Z")
> > 2015/11/26 15:42:03 [info] 42872#0: \*3 SSL\_do\_handshake() failed (SSL: > > error:14094418:SSL routines:ssl3\_read\_bytes:tlsv1 alert unknown ca:SSL alert > > number 48) while SSL handshaking, client: 31.13.113.70, server: 0.0.0.0:4567 > > Went to Facebook and attempted to register a new page subscription > > ([https://developers.facebook.com/docs/graph-api/webhooks/v2.2](https://developers.facebook.com/docs/graph-api/webhooks/v2.2)). Had the error > > reported on the top (SSL\_do\_handshake() failed) when Facebook attempted to > > validate my callback url > > > > Any suggestion? > > Make sure to properly configure certificate chains, see > [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#chains) > [http://nginx.org/en/docs/http/configuring\_https\_servers.html#chains](http://nginx.org/en/docs/http/configuring_https_servers.html#chains) > for details. I’m not entirely sure I understand why I need a certificate chain. The .crt file is what the provider sent me, that’s what I use. Should I “chain” the .crt file the provider sent me with the RapidSSL bundle? This is for testing and development, I don’t really care about performances, a slow solution is perfectly fine ngw