Member Avatar for phoenix_2000

Heya all,

I have a VPS with centOs 7 on it, that has a bit of an issue.
Whenever i try to access my VPS from a browser using httpS://, it gives me the following error:

Secure Connection Failed

An error occurred during a connection to 37.59.111.21:8000. SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long)

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

the content of /etc/httpd/logs/ssl_error_log is as follows:

[Fri Nov 21 10:42:47.411502 2014] [ssl:warn] [pid 284] AH01909: RSA certificate configured for 37.59.111.21:443 does NOT include an ID which matches the server name

From what i could gather, this means my SSL keys got invalidated because the server name is wrong however it did work before.

The only things i did between this error and the last time it did work are:
- installing adjenti (that does work on http)
- changing the DNS to openDNS (as the last one didnt work anymore)
- rebooting the system.

My best guess is that changing the DNS address caused this, but i don't know enough about SSL to know what do now.

  • 2 Contributors
  • 3 Replies
  • 387 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

Short diagnosis and what likely happened (short version). The Firefox error you reported normally means the browser expected a TLS handshake but received non‑TLS/plain HTTP data instead — in other words, HTTPS was attempted to a service that isn’t speaking TLS. The Apache log warning you posted (AH01909) is a separate certificate name mismatch (CN/SAN vs ServerName) that causes certificate warnings but does not itself produce the “record too long” failure. (support.mozilla.org)

Quick, safe checks to run on the VPS (run as root or with sudo):

ss -tulpn | grep ':8000'
curl -v http://127.0.0.1:8000/
openssl s_client -connect 127.0.0.1:8000 -servername your.domain
openssl s_client -connect 127.0.0.1:443 -servername your.domain -showcerts
sudo apachectl -S
sudo tail -n 200 /var/log/httpd/ssl_error_log

If curl returns HTML and openssl s_client to port 8000 fails to negotiate TLS (or shows garbage/plain HTTP), port 8000 is plain HTTP. openssl s_client is the right tool to prove whether a TLS handshake actually occurs. (support.conduktor.io)

How to fix it (practical options). If the service on 8000 is meant to be accessed over HTTP, use . If you want HTTPS for that service, either enable TLS in that service or terminate TLS at Apache/Nginx and proxy to 8000 (configure an SSL VirtualHost with SSLEngine On and a matching certificate). Also fix the AH01909 warning by ensuring your VirtualHost’s ServerName matches the certificate CN or that the certificate includes the hostname in its SAN entries. Check mod_ssl and your SSLCertificateFile/SSLCertificateKeyFile settings when you make changes. (httpd.apache.org)

Notes tied to the thread: was right to ask whether port 8000 is HTTP or HTTPS — that check will identify the real problem quickly. If you post the exact outputs of the ss / curl / openssl s_client tests, the next steps can be made specific (example: sample Apache 443 vhost or a proxy snippet).

Recommended Answers

All 3 Replies

Member Avatar for CimmerianX

In the SSL cert, what do you have as subject or SAN for the hostname? Do you have this same hostname in the .conf file?

Is port 8000 listening for http or https traffic. You can usually recreate this error if you try to https over port 80 to a server.

On your server, what ssl sites do you have enabled?

Member Avatar for phoenix_2000

i don't know exactly what the hostname is, but when i try to connect through https without adding a port, firefox tells me (in an untrusted certificate issue) that it is vps105268.ovh.net, which is kinda weird since my VPS host gave me the number 114574.

When i Nmap the server, it says '8000/tcp open http-alt', while https is at '443/tcp open https'

I'll check the opened SSL sites for apache tomorrow, been enough work for a saturday already :)

Member Avatar for CimmerianX

I went to curl and pull the cert from that host, but I am getting a no host found error on that FQDN.

If you want, msg me the ip address or fqdn and I'll run a few tests to it. At least I can help you ID the cert and ports it's useing.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.