# Trac.nginx.org incorrect https

**URL:** <https://www.ruby-forum.com/t/trac-nginx-org-incorrect-https/242461>\
**Category:** NGINX\
**Created:** [June 25, 2015, 11:17am UTC](https://www.ruby-forum.com/t/trac-nginx-org-incorrect-https/242461 "2015-06-25T11:17:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\
**Post date:** [June 25, 2015, 11:17am UTC](https://www.ruby-forum.com/t/trac-nginx-org-incorrect-https/242461/1 "2015-06-25T11:17:34Z")

</div>

I noticed that [trac.nginx.org](http://trac.nginx.org) has https/SNI configured for the host  
but no actual ssl configuration (how do you even do that):

## $ openssl s\_client -connect [trac.nginx.org:443](http://trac.nginx.org:443) -servername [trac.nginx.org](http://trac.nginx.org) CONNECTED(00000003) 140010415498912:error:14077410:SSL routines:SSL23\_GET\_SERVER\_HELLO:sslv3 alert handshake failure:s23\_clnt.c:770:

## no peer certificate available

## No client certificate CA names sent

## SSL handshake has read 7 bytes and written 318 bytes

## New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE

Relevant (which is how I noticed it in the first place):

> <https://github.com/EFForg/https-everywhere/pull/1993>
>
> The only site in the rule, \`trac\`, doesn't actually work.

---

<div class="post-metadata">

**Author:** ![Edho\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/848f3c/32.png) [@Edho\_A](https://www.ruby-forum.com/u/Edho_A)\
**Post date:** [July 4, 2015, 7:48am UTC](https://www.ruby-forum.com/t/trac-nginx-org-incorrect-https/242461/2 "2015-07-04T07:48:54Z")

</div>

Hello!

On Thu, Jun 25, 2015 at 06:16:42PM +0900, Edho A. wrote:

> I noticed that [trac.nginx.org](http://trac.nginx.org) has https/SNI configured for the host  
> but no actual ssl configuration (how do you even do that):

The [trac.nginx.org](http://trac.nginx.org) domain isn’t available via https.

The IP address [trac.nginx.org](http://trac.nginx.org) maps to does have other sites  
answering on https/SNI though, and to avoid sending invalid  
certificate the “ssl\_ciphers aNULL;” is used in the default server  
configuration. This is what causes the message you see.

> ## SSL handshake has read 7 bytes and written 318 bytes
> 
> ## New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE

JFYI:

You can use something like

$ openssl s\_client -connect trac.nginx.org:443 -servername  
[trac.nginx.org](http://trac.nginx.org) -cipher aNULL

to establish a connection. (Requests won’t work though, as the  
same server also have “return 444;” in the configuration.)

> Relevant (which is how I noticed it in the first place):
> 
> [remove nginx.org by nanaya · Pull Request #1993 · EFForg/https-everywhere · GitHub](https://github.com/EFForg/https-everywhere/pull/1993)

When people try to use something they weren’t asked to, it  
strikes back.

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![Edho\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/848f3c/32.png) [@Edho\_A](https://www.ruby-forum.com/u/Edho_A)\
**Post date:** [July 4, 2015, 7:58am UTC](https://www.ruby-forum.com/t/trac-nginx-org-incorrect-https/242461/3 "2015-07-04T07:58:50Z")

</div>

On Sat, Jul 4, 2015 at 2:48 PM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> answering on https/SNI though, and to avoid sending invalid

Whoever added it probably didn’t actually try accessing the  
site. It has been removed. Thanks.