Lets encryptedで証明書を発行したのに保護されていない通信と出る。

Question

lets encrypted を使い証明書を発行したのですがそのドメインを検索すると保護されていない通信と出てしまいます。

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/hoge.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/hoge.com/privkey.pem
   Your cert will expire on 2020-09-23. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again with the "certonly" option. To non-interactively renew *all*
   of your certificates, run "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

証明書の発行自体は完了しているようですが

Congratulations! You have successfully enabled https://hoge.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=hoge.com

を実行すると以下のようなエラーが出てきますが。調べても解決方法を見つけることができません。

Assessment failed: Unable to connect to the server

Known Problems

There are some errors that we cannot fix properly in the current version. They will be addressed in the next generation version, which is currently being developed.

No secure protocols supported - if you get this message, but you know that the site supports SSL, wait until the cache expires on its own, then try again, making sure the hostname you enter uses the "www" prefix (e.g., "www.ssllabs.com", not just "ssllabs.com").
no more data allowed for version 1 certificate - the certificate is invalid; it is declared as version 1, but uses extensions, which were introduced in version 3. Browsers might ignore this problem, but our parser is strict and refuses to proceed. We'll try to find a different parser to avoid this problem.
Failed to obtain certificate and Internal Error - errors of this type will often be reported for servers that use connection rate limits or block connections in response to unusual traffic. Problems of this type are very difficult to diagnose. If you have access to the server being tested, before reporting a problem to us, please check that there is no rate limiting or IDS in place.
NetScaler issues - some NetScaler versions appear to reject SSL handshakes that do not include certain suites or handshakes that use a few suites. If the test is failing and there is a NetScaler load balancer in place, that's most likely the reason.
Unexpected failure - our tests are designed to fail when unusual results are observed. This usually happens when there are multiple TLS servers behind the same IP address. In such cases we can't provide accurate results, which is why we fail.
Common Error Messages

Connect timed out - server did not respond to our connection request, sometimes before we are dynamically blocked when our tests are detected
No route to host - unable to reach the server
Unable to connect to server - failed to connect to the server, it usually happens due to firewall restrictions
Connection reset - we got disconnected from the server
Unrecognized SSL message, plaintext connection? - the server responded with plain-text HTTP on HTTPS port
Received fatal alert: handshake_failure - this is either a faulty SSL server or some other server listening on port 443; if the SSL version of the web site works in your browser, please report this issue to us
Failed to communicate with the secure server - No secure protocol supported. Possibly this server only supports a draft version of TLS 1.3

Comments

[CHERRY]

Web サーバーのログには、どのようなメッセージが記録されているのでしょうか？

[atage517]

長くてすべては見せれませんがこのようなメッセージが複数ありました。

111.111.11.111 - - [26/Jun/2020:10:36:54 +0900] "GET /noindex/css/fonts/Bold/OpenSans-Bold.woff HTTP/1.1" 404 239 "http://www.hoge.com/noindex/css/open-sans.css" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36"

[atage517]

エラーログはこのようなものがたくさんありました！

[Fri Jun 26 10:36:58.670026 2020] [rewrite:trace1] [pid 3059] mod_rewrite.c(470): [client 111.111.111.111:60629] 111.111.111.111 - - [www.hoge.com/sid#55613072bf48][rid#5561307ce958/initial/redir#1] pass through /.noindex.html
[Fri Jun 26 10:36:59.558148 2020] [rewrite:trace2] [pid 3059] mod_rewrite.c(470): [client 111.111.111:60629] 111.111.111.111 - - [www.hoge.com/sid#55613072bf48][rid#5561307cf230/initial] init rewrite engine with requested uri /noindex/css/fonts/Bold/OpenSans-Bold.woff, referer: http://www.hoge.com/noindex/css/open-sans.css

Answer 1

 firewall-cmd --zone=public --add-port=443/tcp --permanent

でfirewallの443ポートを解放して

firewall-cmd --reload

 firewall-cmd --list-all

でportsに433があれば解決しました

Answer 2

質問にある URL へのアクセスを確認しました。
mixed content の警告は出ますが、サーバの https 対応はできています。

Comments

[atage517]

質問にあるURLとはどのURLのことですか？