初めて質問させていただきます。
前提・実現したいこと
さくらVPSサーバーにてSSLを導入し、Webサイトの構築を行いたいのですが、
発生している問題・エラーメッセージ
このサイトは安全に接続できません
sample-web.com から無効な応答が送信されました。
ERR_SSL_PROTOCOL_ERROR
該当のソースコード
nginx
1 #nginx.conf
2 user nginx ;
3 worker_processes auto ;
4 worker_rlimit_nofile 100000 ;
5
6
7 error_log / var / log / nginx / error . log warn ;
8 pid / var / run / nginx . pid ;
9
10
11 events {
12 worker_connections 2048 ;
13 multi_accept on ;
14 use epoll ;
15 }
16
17
18 http {
19 include / etc / nginx / mime . types ;
20 default_type application / octet - stream ;
21
22 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
23 '$status $body_bytes_sent "$http_referer" '
24 '"$http_user_agent" "$http_x_forwarded_for"' ;
25
26 access_log / var / log / nginx / access . log main ;
27 server_tokens off ;
28 sendfile on ;
29 #tcp_nopush on;
30
31 keepalive_timeout 10 ;
32 client_header_timeout 10 ;
33 client_body_timeout 10 ;
34 reset_timedout_connection on ;
35 send_timeout 10 ;
36 limit_conn_zone $binary_remote_addr zone = addr : 5 m ;
37 limit_conn addr 100 ;
38
39 gzip on ;
40 gzip_http_version 1.0 ;
41 gzip_disable "msie6" ;
42 gzip_proxied any ;
43 gzip_min_length 1024 ;
44 gzip_comp_level 6 ;
45 gzip_types text / plain text / css application / x - javascript text / xml application / xml application / xml + rss text / javascript application / javascript application / json ;
46 open_file_cache max = 100000 inactive = 20 s ;
47 open_file_cache_valid 30 s ;
48 open_file_cache_min_uses 2 ;
49 open_file_cache_errors on ;
50
51
52 include / etc / nginx / conf . d / * . conf ;
53 }
nginx
1 server {
2 listen 443 ssl ;
3 ssl_certificate / etc / nginx / ssl / ssl . crt ; # crt file
4 ssl_certificate_key / etc / pki / tls / certs / server . key ; # secret key
5 server_name sample - web . com ;
6 ssl_protocols TLSv1 TLSv1 . 1 TLSv1 . 2 ;
7 ssl_ciphers ECDHE - RSA - AES128 - GCM - SHA256 : ECDHE - ECDSA - AES128 - GCM - SHA256 : ECDHE - RSA - AES256 - GCM - SHA384 : ECDHE - ECDSA - AES256 - GCM - SHA384 : DHE - RSA - AES128 - GCM - SHA256 : DHE - DSS - AES128 - GCM - SHA256 : kEDH + AESGCM : ECDHE - RSA - AES128 - SHA256 : ECDHE - ECDSA - AES128 - SHA256 : ECDHE - RSA - AES128 - SHA : ECDHE - ECDSA - AES128 - SHA : ECDHE - RSA - AES256 - SHA384 : ECDHE - ECDSA - AES256 - SHA384 : ECDHE - RSA - AES256 - SHA : ECDHE - ECDSA - AES256 - SHA : DHE - RSA - AES128 - SHA256 : DHE - RSA - AES128 - SHA : DHE - DSS - AES128 - SHA256 : DHE - RSA - AES256 - SHA256 : DHE - DSS - AES256 - SHA : DHE - RSA - AES256 - SHA : AES128 - GCM - SHA256 : AES256 - GCM - SHA384 : AES128 - SHA256 : AES256 - SHA256 : AES128 - SHA : AES256 - SHA : AES : CAMELLIA : DES - CBC3 - SHA : ! aNULL : ! eNULL : ! EXPORT : ! DES : ! RC4 : ! MD5 : ! PSK : ! aECDH : ! EDH - DSS - DES - CBC3 - SHA : ! EDH - RSA - DES - CBC3 - SHA : ! KRB5 - DES - CBC3 - SHA ;
8 ssl_prefer_server_ciphers on ;
9 location / {
10 root / usr / share / nginx / html ;
11 index index . html ;
12 }
13
14
15 }
試したこと
Nginxの設定に不備があるかどうか
linux
1 nginx -t
2 ↓
3 nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
4 nginx: configuration file /etc/nginx/nginx.conf test is successful
httpでは接続できるか
nginx
1 server {
2 listen 80 ;
3 server_name sample - web . com ;
4
5 charset koi8 - r ;
6 access_log / var / log / nginx / host . access . log main ;
7
8
9
10 location / {
11 root / usr / share / nginx / html ;
12 index index . html index . htm ;
13 }
14 }
15 ↓
16 index . htmlが表示されました
firewallの設定の確認
linux
1 firewall-cmd --list-all
2 public (active)
3 target: default
4 icmp-block-inversion: no
5 interfaces: eth0
6 sources:
7 services: dhcpv6-client ssh-51110 http https
8 ports:
9 protocols:
10 masquerade: no
11 forward-ports:
12 source-ports:
13 icmp-blocks:
14 rich rules:
以下頂いた回答から行った事です。
####opensslでの確認
linux
1 CONNECTED(00000003)
2 139875657488272:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
3 ---
4 no peer certificate available
5 ---
6 No client certificate CA names sent
7 ---
8 SSL handshake has read 7 bytes and written 289 bytes
9 ---
10 New, (NONE), Cipher is (NONE)
11 Secure Renegotiation IS NOT supported
12 Compression: NONE
13 Expansion: NONE
14 No ALPN negotiated
15 SSL-Session:
16 Protocol : TLSv1.2
17 Cipher : 0000
18 Session-ID:
19 Session-ID-ctx:
20 Master-Key:
21 Key-Arg : None
22 Krb5 Principal: None
23 PSK identity: None
24 PSK identity hint: None
25 Start Time: 1535102954
26 Timeout : 300 (sec)
27 Verify return code: 0 (ok)
28 ---
29
こちら(http://d.hatena.ne.jp/rougeref/20170519)を元に
####秘密鍵、CSR、証明書に不備がないかどうか
linux
1 CSRのModulusを確認
2 openssl req -in server.csr -modulus -noout
3 SSLサーバ証明書のModulusを確認
4 openssl x509 -in ssl.crt -modulus -noout
5 秘密鍵のModulusを確認
6 openssl rsa -in server.key -modulus -noout
7 整合性確認いたしました。
8
9 秘密鍵が破損していないことの確認
10 openssl rsa -in server.key -check -noout
11 問題なし
12
13 SSL証明書内容確認
14 openssl x509 -in ssl.crt -text -noout
15
16 Subject: CN=sample-web.com
17 CPS: https://www.digicert.com/CPS
18 証明書の設定に不備見られませんでした
補足情報（FW/ツールのバージョンなど）
CentOS Linux release 7.5.1804 (Core)
Q&A
自己解決
下記のような回答は推奨されていません。
このような回答には修正を依頼しましょう。