# Ssl/tls https with red cross **URL:** \ **Category:** NGINX\ **Created:** [May 30, 2012, 5:45pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149 "2012-05-30T17:45:51Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\ **Post date:** [May 30, 2012, 5:45pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149/1 "2012-05-30T17:45:51Z")
Hi, Looking to get some help from the group . We are running nginx/0.7.62 and notice that https with red-cross (either the connection is not encrypted or the page has some non https content and in my case it is no encrypted connection ) this is how thw config looks server { listen 443; server\_name [login.jobsgulf.com](http://login.jobsgulf.com); access\_log on; ssl on; ssl\_certificate login.jobsgulf.com.crt; ssl\_certificate\_key login.jobsgulf.com.key; ssl\_protocols SSLv3 TLSv1 ; # ssl\_ciphers HIGH:!aNULL:!MD5; ``` ssl_ciphers ``` ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; keepalive\_timeout 60; ssl\_session\_cache shared:SSL:10m; ssl\_session\_timeout 10m; I want to know if we really have to explicitly specify ssl\_protocols and ssl\_ciphers in the config in order to be fully https for the said directive ?? Also does it make sense to enable ssl/tls support on apache also ? in my case i have nginx in front of the apache . ---
**Author:** ![ganaiwali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/dbc845/32.png) [@ganaiwali](https://www.ruby-forum.com/u/ganaiwali)\ **Post date:** [May 30, 2012, 6:55pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149/2 "2012-05-30T18:55:54Z")
On Wednesday 30 May 2012 19:44:59 tariq wali wrote: […] > I want to know if we really have to explicitly specify ssl\_protocols and > ssl\_ciphers in the config in order to be fully https for the said directive > ?? Most of the directives in nginx have their default values​​. Please, check the documentation if you want to know them: [Module ngx\_http\_ssl\_module](http://nginx.org/r/ssl_protocols) [Module ngx\_http\_ssl\_module](http://nginx.org/r/ssl_ciphers) > Also does it make sense to enable ssl/tls support on apache also ? in my > case i have nginx in front of the apache . Depends on your purposes. But since you asked, probably, it doesn’t make sense in your case. In general, if all requests come in via HTTP, then the HTTPS support is meaningless. wbr, Valentin V. Bartenev ---
**Author:** ![ganaiwali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/dbc845/32.png) [@ganaiwali](https://www.ruby-forum.com/u/ganaiwali)\ **Post date:** [May 30, 2012, 8:13pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149/3 "2012-05-30T20:13:58Z")
On Wed, May 30, 2012 at 09:14:59PM +0530, tariq wali wrote: Hi there, > We are running nginx/0.7.62 and notice that https with red-cross (either > the connection is not encrypted or the page has some non https content and > in my case it is no encrypted connection ) this is how thw config looks It’s not clear from the above paragraph what the problem you are seeing is. Are you sure that for your client, “https with red-cross” means only one of those two possibilities? Might it mean “this is ssl-encrypted, but the client has not validated the certificate, so it can’t say who it is having an encrypted conversation with”? > server { > listen 443; > ssl on; > ssl\_certificate login.jobsgulf.com.crt; > ssl\_certificate\_key login.jobsgulf.com.key; For testing purposes, the above four lines are enough to get nginx responding over https. If you see the same problem when leaving out the rest, then you now have a simpler case to test from. If you don’t see the same problem when leaving out the rest, then you can try adding back the lines one at a time, to see what causes the problem to come back. > I want to know if we really have to explicitly specify ssl\_protocols and > ssl\_ciphers in the config in order to be fully https for the said directive > ?? No. > Also does it make sense to enable ssl/tls support on apache also ? in my > case i have nginx in front of the apache . Probably not. If the problem you see is that when you do curl -i [https://your-server/](https://your-server/) or curl -k -i [https://your-server/](https://your-server/) you get back content with links (image, css, javascript) to http:// urls, then you’ll probably want to adjust what the back-end (apache) sends. The first thing to do is probably to identify precisely why your browser shows you the red cross. Hopefully it has some form of reporting which will tell you. After that, you will probably have a specific question which will hopefully have a straightforward answer. Good luck with it, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![ganaiwali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/dbc845/32.png) [@ganaiwali](https://www.ruby-forum.com/u/ganaiwali)\ **Post date:** [June 1, 2012, 4:43pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149/4 "2012-06-01T16:43:05Z")
On Friday 01 June 2012 18:17:17 tariq wali wrote: > failed (SSL: error:06065064:digital envelope > routines:EVP\_DecryptFinal\_ex:bad decrypt error:0906A065:PEM > routines:PEM\_do\_header:bad decrypt error:140B0009:SSL > routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) Nginx doesn’t know passphrase for your private key file. You need to remove it. wbr, Valentin V. Bartenev ---
**Author:** ![ganaiwali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/dbc845/32.png) [@ganaiwali](https://www.ruby-forum.com/u/ganaiwali)\ **Post date:** [June 1, 2012, 4:17pm UTC](https://www.ruby-forum.com/t/ssl-tls-https-with-red-cross/220149/5 "2012-06-01T16:17:58Z")
can anyone please tell why this error on my nginx instance with ssl/tls 2012/06/01 10:06:12 [emerg] 20286#0: SSL\_CTX\_use\_PrivateKey\_file("/usr/local/nginx/conf/login.jobsgulf.com.key") failed (SSL: error:0906406D:PEM routines:PEM\_def\_callback:problems getting password error:0906A068:PEM routines:PEM\_do\_header:bad password read error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib) 2012/06/01 10:06:20 [emerg] 866#0: SSL\_CTX\_use\_PrivateKey\_file("/usr/local/nginx/conf/login.jobsgulf.com.key") failed (SSL: error:06065064:digital envelope routines:EVP\_DecryptFinal\_ex:bad decrypt error:0906A065:PEM routines:PEM\_do\_header:bad decrypt error:140B0009:SSL routines:SSL\_CTX\_use\_PrivateKey\_file:PEM lib)