0

I've copied all of the referenced files in my nginx configuration over:

  • /etc/nginx/ssl/STAR_example_com/ssl-bundle.crt
  • /etc/nginx/ssl/STAR_example_com/STAR_example.key
  • /etc/ssl/certs/dhparam.pem

I was optimistic that might be all I'd need to do, but didn't believe it would be...

When I browse to https://new.example.com it just spins, and eventually times out.

I have configured my DNS correctly, I believe. dig seems to confirm this. I have configured my firewall correctly, I believe. firewall-cmd --list-all shows services: cockpit dhcpv6-client http https ssh.

The site was working on http://<ipaddress>/. For the domain I have no option but to use https rather than http (as one might, for testing etc) as it's preloaded HSTS.

What am I missing? I'm completely clueless when it comes to certs. Is it the STAR_example.key file - should that be a private key relating to the machine it's on? If so how do I generate a new one?

The fact that it's timing out rather than coming back with an error of some sort has me stumped...

Thank you!

1

It sounds to me very much like you have not enabled and configured NGINX to listen on port 443 (and I'm guessing you have not told it where to find the certs either).

https://nginx.org/en/docs/http/configuring_https_servers.html tells you how to configure https - to summarise - typically add something like the following to your NGINX config file -

  server {
      listen              443 ssl;
      server_name         www.example.com;
      ssl_certificate     www.example.com.crt;
      ssl_certificate_key www.example.com.key;
      ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers         HIGH:!aNULL:!MD5;
  }

Your NGINX config files can be found at /etc/nginx - I expect you can add it to /etc/nginx/nginx.conf but there is likely to be a directory structure with subdirectories which include files which could be more elegant.

Once you have made the changes you will want to reload the config -

   sudo systemctl reload nginx
1
  • Actually it was a separate firewall at the ISP that needed configuring in the management console. 80 was open, 443 wasn't. Sorry, I meant to come and delete the question but got sidetracked! – Codemonkey Nov 12 '20 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.