This obviously gives me a rewrite loop, since apache forces https, and
nginx keeps trying http.
When I change http to https in the location blocks, I get a 502 bad
gateway error, and the nginx log tells me
My interpretation is that nginx does not know how to handle the upstream
ssl connection. Is that correct?
How can I configure nginx to do that? Is that possible at all?
Not sure if its of interest, but: nginx has the ssl certs for
www.acme.eu configured correctly, but thats for the side where nginx is
the server to the client.
Of course, an option would be to drop the https forcing in the apache,
and put the forcing in nginx, but currently that is not an option, as we
are in a testing phase, where the proxied and unproxied versions of the
site must be available.
If you define your backends via upstream {} add also :443 port there.
I defined my upstream like this:
upstream backend-secure {
server 10.10.2.1:443 max_fails=20;
server 10.10.2.1:443 max_fails=20;
}
and my proxy pass
location ~* .(jpg|gif|png|css|js) {
try_files $uri @proxy;
}
location @proxy {
proxy_pass https://backend-secure;
}
location / {
proxy_pass https://backend-secure;
}
Can you show what does this return ( change the 10.10.2.1 to your
backend apache ip/host if its not the real one from the error message):
openssl s_client -connect 10.10.2.1:443
Its the same error as with nginx:
~# openssl s_client -connect 10.10.2.1:443
CONNECTED(00000003)
7571:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:607:
It will either return the SSL cert information (then the backend is fine
and the problem is on nginx side) or the same error.
This would imply that the problem is on the backend (the apache) side.
But: I can connect to the backend directly (not via nginx) using https
without any problem. So I am not sure about this conclusion.
Hm, it might still be a problem with the backend, but its not that ssl
is not working in general on the backend.
hi all ,
I’m getting the same , my upstream https servers requires client
authenication (ie authenicate who nginx is!!) but this fails, yet when
i verfied the same using wget alls okay … btw i using self sign
certs for now
I get the a 502 bad gateway too … does nginx support this
configuration or have i messed up my ssl configuration
Hi all, here some further info on the issue, from my investigation into
2-way ssl support to upstream servers , i gathered the following ssl out
form my upstream server . You can see the problem occurs after the
server handshake the certificate chain is not found for nginx
*** Certificate chain
It’s the problem on backend then - it doesn’t (want to) talk ssl, at
least on that particular IP/port.
Yes, that was the problem. The apache was configured to speak https on
port 45600. So I changed my backend definition acordingly, and things
worked!
Thank you very much for your guidance!
Not directly related, but just for the record:
The site contains a login, which needed a
proxy_set_header Host $host;
in the location section with the proxy_pass in order to work.
If you test with browser it might (out of thin air) not complain about
the site not actually being SSL or the apache does some sort of redirect
before actually landing on the real SSL (virtual)host.
Yes, there is a loadbalancer, which did the port changing bevore the
request came to apache.
On Tue, Jul 17, 2012 at 01:30:06PM -0400, saucepan wrote:
hi all ,
I’m getting the same , my upstream https servers requires client
authenication (ie authenicate who nginx is!!) but this fails, yet when
i verfied the same using wget alls okay … btw i using self sign
certs for now
I get the a 502 bad gateway too … does nginx support this
configuration or have i messed up my ssl configuration
nginx doesn’t currently support client certificate authentication
to upstream https servers.
openssl s_client -connect 10.10.2.1:443
Its the same error as with nginx:
~# openssl s_client -connect 10.10.2.1:443
CONNECTED(00000003)
7571:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:607:
It’s the problem on backend then - it doesn’t (want to) talk ssl, at
least on that particular IP/port.
But: I can connect to the backend directly (not via nginx) using https without
any problem. So I am not sure about this
conclusion.
Can you show what does this return: wget --no-check-certificate -S
–spider https://10.10.2.1
If you test with browser it might (out of thin air) not complain about
the site not actually being SSL or the apache does some sort
of redirect before actually landing on the real SSL (virtual)host.
But overall you should probably show your apache config (the parts with
‘SSLEngine on’ ).
rr
This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.
