# Unable connect to NGX website from Safari **URL:** \ **Category:** NGINX\ **Created:** [July 29, 2011, 11:12pm UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080 "2011-07-29T23:12:56Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [July 29, 2011, 11:12pm UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/1 "2011-07-29T23:12:56Z")
Hello, We can not access NGX website with Safari, the error window shows: No certificate available No certificates meet the applications Click OK to continue. However, after I click OK, it does not go to website. I have on problem to connect website using Firefox, IE, or Chrome. Any idea how to solve it from NGX site? Thanks, Yanxin ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [July 30, 2011, 11:06pm UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/2 "2011-07-30T23:06:34Z")
Am 7/29/2011 11:12 PM, schrieb Yanxin Z.: > Hello, > We can not access NGX website with Safari, the error window shows: > No certificate available > No certificates meet the applications > Click OK to continue. > > However, after I click OK, it does not go to website. > > I have on problem to connect website using Firefox, IE, or Chrome. It’s probably a problem with your configuration. Hard to tell what the problem is exactly without having a clue about your actual configuration details. The first thing I would do is to use curl to debug the situation. It has very verbose output, so you can see exactly what’s going on. Since it’s working with all browsers but Safari, my guess it’s an error situation that the other browsers can deal with, hence it should be a more common issue. ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 1:48am UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/3 "2011-08-02T01:48:40Z")
Hi my config is here: ``` ssl on; ssl_certificate ssl/eng.cert.pem; ssl_certificate_key ssl/key.nopasswd.pem; ssl_client_certificate ssl/ca.crt; ssl_verify_client optional; ssl_verify_depth 2; ssl_session_timeout 5m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ``` ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl\_prefer\_server\_ciphers on; I also dump the packet with wireshark. It showd “server Hello” did not finish with client side. The issue only happens in Safari 5.1 Thank you! Yanxin ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 3:51am UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/4 "2011-08-02T03:51:41Z")
Can you also provide HTTP header and ssl logs? James ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 7:47am UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/5 "2011-08-02T07:47:15Z")
On Tue, Aug 02, 2011 at 06:55:05AM +0200, Yanxin Z. wrote: > Hi James, > Thank you very much. > Do you mean turn on NGX debug log? Could you please tell me how to get > it? > Right now, I turn on error and access log only, however, I do not see > any log in NGX side. > > The issue happens in Safari 5.1 (7354.50), which I downloaded from > Apple. > Yanxin > **[A debugging log](http://nginx.org/en/docs/debugging_log.html)** – Igor S. ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 9:20am UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/6 "2011-08-02T09:20:48Z")
Hi Igor, I turned on debug log, but I do not see any information associated with the connection. I have the pcap file which was captured from wireshark. Do you want to take a look? I can send it to your mailbox then. Thank you. Yanxin ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 6:55am UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/7 "2011-08-02T06:55:05Z")
Hi James, Thank you very much. Do you mean turn on NGX debug log? Could you please tell me how to get it? Right now, I turn on error and access log only, however, I do not see any log in NGX side. The issue happens in Safari 5.1 (7354.50), which I downloaded from Apple. Yanxin ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 11:29pm UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/8 "2011-08-02T23:29:03Z")
Thank you so much for you help, Igor. To sum up, the issue is related with ssl\_verify\_client optional; Safari 5 also send client certificate to NGX server, which does not have needed information. For other browser, there is no such behavior. Right now, I comment out this line, then it’s working now. Thank you, Igor. Yanxin ---
**Author:** ![yanxin\_z](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/d6d6ee/32.png) [@yanxin\_z](https://www.ruby-forum.com/u/yanxin_z)\ **Post date:** [August 2, 2011, 4:36pm UTC](https://www.ruby-forum.com/t/unable-connect-to-ngx-website-from-safari/210080/9 "2011-08-02T16:36:13Z")
On Tue, Aug 02, 2011 at 09:20:48AM +0200, Yanxin Z. wrote: > Hi Igor, > I turned on debug log, but I do not see any information associated with > the connection. > I have the pcap file which was captured from wireshark. Do you want to > take a look? I can send it to your mailbox then. > Thank you. > Yanxin OK, please send this to me, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) – Igor S.