Сбой ssl квитирования код ошибки 525

Installing a Secure Sockets Layer (SSL) certificate on your WordPress site enables it to use HTTPS to ensure secure connections. Unfortunately, there are a variety of things that can go wrong in the process of confirming a valid SSL certificate and making a connection between your site’s server and a visitor’s browser.

If you’ve encountered an “SSL Handshake Failed” error message and are confused as to what it means, you’re not alone. It’s a common error that doesn’t tell you much on its own. While this can be a frustrating experience, the good news is that there are simple steps you can take to resolve the issue.

In this post, we’ll explain what the SSL Handshake Failed error is and what causes it. Then we’ll provide you with several methods you can use to fix it.

Let’s get started!

An Introduction to the SSL Handshake

Before we dig deeper into what causes a TLS or SSL handshake failure, it’s helpful to understand what the TLS/SSL handshake is. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are protocols used to authenticate data transfers between servers and external systems such as browsers.

SSL certificates are needed in order to secure your website using HTTPS. We won’t get too in-depth about the difference between TLS vs SSL since it’s a minor one. The terms are often used interchangeably, so for simplicity’s sake, we’ll use “SSL” to refer to both.

With that out of the way, an SSL handshake is the first step in the process of establishing an HTTPS connection. To authenticate and establish the connection, the user’s browser and the website’s server must go through a series of checks (the handshake), which establish the HTTPS connection parameters.

Let us explain: the client (typically the browser) sends a request for a secure connection to the server. After the request is sent, the server sends a public key to your computer and checks that key against a list of certificates. The computer then generates a key and encrypts it, using the public key sent from the server.

To make a long story short, without the SSL handshake, a secure connection won’t be made. This can pose a significant security risk. Plus, there are a lot of moving parts involved in the process.

That means there are many different opportunities for something to go wrong and cause a handshake failure, or even lead to the “your connection is not private” error, causing visitors to leave.

Confronted with the ‘SSL Handshake Failed’ error? 🤝 Get a grip on how to solve it with these 5 methods ⤵️Click to Tweet

Understanding What Causes SSL Handshake Failures

An SSL Handshake Failure or Error 525 means that the server and browser were unable to establish a secure connection. This can happen for a variety of reasons.

Generally, an Error 525 means that the SSL handshake between a domain using Cloudflare and the origin web server failed:

However, it’s also important to understand that SSL errors can happen on the client-side or the server-side. Common causes of SSL errors on the client-side include:

• The wrong date or time on the client device.
• An error with the browser configuration.
• A connection that is being intercepted by a third party.

Some server-side causes include:

• A cipher suite mismatch.
• A protocol used by the client that isn’t supported by the server.
• A certificate that is incomplete, invalid, or expired.

Typically, if the SSL handshake fails, the issue can be attributed to something wrong with the website or server and their SSL configurations.

How to Fix the SSL Handshake Failed Error (5 Methods)

There are several potential causes behind the “SSL Handshake Failed” error. So there’s no simple answer when it comes to how you should fix it.

Fortunately, there are a handful of methods you can use to begin exploring potential issues and resolving them one by one. Let’s take a look at five strategies you can use to try and fix the SSL Handshake Failed error.

1. Update Your System Date and Time

Let’s start with one of the more unlikely causes, but one that is incredibly easy to correct if it is the problem: your computer’s clock.

If your system is using the wrong date and time, that may interrupt the SSL handshake. When the system clock is different than the actual time, for example, if it’s set too far into the future, it can interfere with the SSL certificate verification.

Your computer’s clock might have been set incorrectly due to human error or simply due to a glitch in your settings. Whatever the reason, it’s a good idea to check and make sure your system time is correct, and update it if it’s not.

Of course, if your clock is showing the correct information, it’s safe to assume that this isn’t the source of the “SSL Handshake Failed” issue.

2. Check to See If Your SSL Certificate Is Valid

Expiration dates are placed on SSL certificates, to help make sure their validation information remains accurate. Generally, the validity of these certificates lasts for anywhere between six months and two years.

If an SSL certificate is revoked or expired, the browser will detect this and be unable to complete the SSL handshake. If it’s been more than a year or so since you installed an SSL certificate on your website, it might be time to reissue it.

To view the status of your SSL certificate, you can use an SSL certificate checker tool such as the one offered by Qualys:

This tool is both reliable and free to use. All you need to do is input your domain name into the Hostname field, and then click on Submit. Once the checker is done analyzing your site’s SSL configuration, it will present you with some results:

On this page, you can find out if your certificate is still valid and see if it has been revoked for any reason.

In either case, updating your SSL certificate should resolve the handshake error (and is vital for keeping your site and your WooCommerce store secure).

3. Configure Your Browser for the Latest SSL/TLS Protocol Support

Sometimes the best way to determine the root cause of an issue is by process of elimination. As we mentioned earlier, the SSL handshake failure can often occur due to a browser misconfiguration.

The quickest way to determine whether a particular browser is the problem is to try switching to a different one. This can at least help narrow down the problem. You may also try disabling any plugins and resetting your browser back to its default settings.

Another potential browser-related issue is a protocol mismatch. For example, if the server only supports TLS 1.2, but the browser is only configured for TLS 1.0 or TLS 1.1, there’s no mutually-supported protocol available. This will inevitably lead to an SSL handshake failure.

How you can check to see if this problem is occurring varies based on the browser you’re using. As an example, we’ll look at how the process works in Chrome. First, open your browser and go to Settings > Advanced. This will expand a number of menu options.

Under the System section, click on Open your computer’s proxy settings:

This will open up a new window. Next, select the Advanced tab. Under the Security section, check to see if the box next to Use TLS 1.2 is selected. If not, check that option:

It’s also recommended that you uncheck the boxes for SSL 2.0 and SSL 3.0.

The same applies to TLS 1.0 and TLS 1.1 since they are being phased out. When you’re done, click on the OK button, and check to see if the handshake error has been resolved.

Note that if you’re using Apple Safari or Mac OS there isn’t an option to enable or disable SSL protocols. TLS 1.2 is automatically enabled by default. If you’re using Linux, you can refer to the Red Hat guide on TLS hardening.

4. Verify That Your Server Is Properly Configured to Support SNI

It’s also possible that the SSL handshake failure is being caused by improper Server Name Indication (SNI) configuration. The SNI is what enables a web server to securely host several TLS certificates for one IP address.

Each website on a server has its own certificate. However, if the server isn’t SNI-enabled, that can result in an SSL handshake failure, because the server may not know which certificate to present.

There are a few ways to check and see whether a site requires SNI. One option is to use Qualys’ SSL Server Test, which we discussed in the previous section. Input your site’s domain name, and then click on the Submit button.

On the results page, look for a message that reads “This site works only in browsers with SNI support”:

Another approach for detecting if a server is using SNI is to browse the server names in the ‘ClientHello’ message. This is a more technical process, but it can offer a lot of information.

It involves checking the extended hello header for a ‘server_name’ field, to see if the correct certifications are presented.

If you’re familiar with using tools such as the OpenSSL toolkit and Wireshark, you might find this method preferable. You can use openssl s_client with and without the -servername option:

# without SNI
 $ openssl s_client -connect host:port 

 # use SNI
 $ openssl s_client -connect host:port -servername host

If you get two different certificates with the same name, it means that the SNI is supported and properly configured.

However, if the output in the returned certificates is different, or the call without SNI cannot establish an SSL connection, it indicates that SNI is required but not correctly configured. Resolving this issue may require switching to a dedicated IP address.

5. Make Sure the Cipher Suites Match

If you still haven’t been able to identify the cause of the SSL handshake failure, it might be due to a cipher suite mismatch. In case you’re unfamiliar with the term, ‘cipher suites’ refer to a set of algorithms, including ones for key exchange, bulk encryption, and message authentication code, that can be used for securing SSL and TLS network connections.

If the cipher suites that a server uses don’t support or match what’s used by Cloudflare, that can result in an “SSL Handshake Failed” error.

When it comes to figuring out whether there is a cipher suite mismatch, Qualys’ SSL Server Test proves yet again to be a useful tool.

When you input your domain and click on Submit, you’ll see a summary analysis page. You can find the cipher information under the Cipher Suites section:

You can use this page to discover which ciphers and protocols the server supports. You’ll want to look out for any that display the ‘weak’ status. In addition, this section also details the specific algorithms for the cipher suites.

To correct this issue, you can compare the results against what your browser supports by using the Qualys SSL/TLS Capabilities of Your Browser tool. For more extensive information and guidance about cipher suites, we also recommend checking out the ComodoSSLStore guide.

Confused by the ‘SSL Handshake Failed’ error message? This guide explains what it is and, most importantly, 5 ways to fix it 🙌Click to Tweet

Summary

One of the most perplexing yet common types of SSL-related problems is the “SSL Handshake Failed” error. Dealing with this error can be stressful since it has many potential causes, including both client- and server-side issues.

However, there are some reliable solutions you can use to identify the problem and resolve it. Here are five ways you can use to fix the SSL Handshake Failed error:

1. Update your system date and time.
2. Check to see if your SSL certificate is valid (and reissue it if necessary).
3. Configure your browser to support the latest TLS/SSL versions.
4. Verify that your server is properly configured to support SNI.
5. Make sure the cipher suites match.

Installing a Secure Sockets Layer (SSL) certificate on your WordPress site enables it to use HTTPS to ensure secure connections. Unfortunately, there are a variety of things that can go wrong in the process of confirming a valid SSL certificate and making a connection between your site’s server and a visitor’s browser.

If you’ve encountered an “SSL Handshake Failed” error message and are confused as to what it means, you’re not alone. It’s a common error that doesn’t tell you much on its own. While this can be a frustrating experience, the good news is that there are simple steps you can take to resolve the issue.

In this post, we’ll explain what the SSL Handshake Failed error is and what causes it. Then we’ll provide you with several methods you can use to fix it.

Let’s get started!

An Introduction to the SSL Handshake

Before we dig deeper into what causes a TLS or SSL handshake failure, it’s helpful to understand what the TLS/SSL handshake is. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are protocols used to authenticate data transfers between servers and external systems such as browsers.

SSL certificates are needed in order to secure your website using HTTPS. We won’t get too in-depth about the difference between TLS vs SSL since it’s a minor one. The terms are often used interchangeably, so for simplicity’s sake, we’ll use “SSL” to refer to both.

With that out of the way, an SSL handshake is the first step in the process of establishing an HTTPS connection. To authenticate and establish the connection, the user’s browser and the website’s server must go through a series of checks (the handshake), which establish the HTTPS connection parameters.

Let us explain: the client (typically the browser) sends a request for a secure connection to the server. After the request is sent, the server sends a public key to your computer and checks that key against a list of certificates. The computer then generates a key and encrypts it, using the public key sent from the server.

To make a long story short, without the SSL handshake, a secure connection won’t be made. This can pose a significant security risk. Plus, there are a lot of moving parts involved in the process.

That means there are many different opportunities for something to go wrong and cause a handshake failure, or even lead to the “your connection is not private” error, causing visitors to leave.

Confronted with the ‘SSL Handshake Failed’ error? 🤝 Get a grip on how to solve it with these 5 methods ⤵️Click to Tweet

Understanding What Causes SSL Handshake Failures

An SSL Handshake Failure or Error 525 means that the server and browser were unable to establish a secure connection. This can happen for a variety of reasons.

Generally, an Error 525 means that the SSL handshake between a domain using Cloudflare and the origin web server failed:

However, it’s also important to understand that SSL errors can happen on the client-side or the server-side. Common causes of SSL errors on the client-side include:

• The wrong date or time on the client device.
• An error with the browser configuration.
• A connection that is being intercepted by a third party.

Some server-side causes include:

• A cipher suite mismatch.
• A protocol used by the client that isn’t supported by the server.
• A certificate that is incomplete, invalid, or expired.

Typically, if the SSL handshake fails, the issue can be attributed to something wrong with the website or server and their SSL configurations.

How to Fix the SSL Handshake Failed Error (5 Methods)

There are several potential causes behind the “SSL Handshake Failed” error. So there’s no simple answer when it comes to how you should fix it.

Fortunately, there are a handful of methods you can use to begin exploring potential issues and resolving them one by one. Let’s take a look at five strategies you can use to try and fix the SSL Handshake Failed error.

1. Update Your System Date and Time

Let’s start with one of the more unlikely causes, but one that is incredibly easy to correct if it is the problem: your computer’s clock.

If your system is using the wrong date and time, that may interrupt the SSL handshake. When the system clock is different than the actual time, for example, if it’s set too far into the future, it can interfere with the SSL certificate verification.

Your computer’s clock might have been set incorrectly due to human error or simply due to a glitch in your settings. Whatever the reason, it’s a good idea to check and make sure your system time is correct, and update it if it’s not.

Of course, if your clock is showing the correct information, it’s safe to assume that this isn’t the source of the “SSL Handshake Failed” issue.

2. Check to See If Your SSL Certificate Is Valid

Expiration dates are placed on SSL certificates, to help make sure their validation information remains accurate. Generally, the validity of these certificates lasts for anywhere between six months and two years.

If an SSL certificate is revoked or expired, the browser will detect this and be unable to complete the SSL handshake. If it’s been more than a year or so since you installed an SSL certificate on your website, it might be time to reissue it.

To view the status of your SSL certificate, you can use an SSL certificate checker tool such as the one offered by Qualys:

This tool is both reliable and free to use. All you need to do is input your domain name into the Hostname field, and then click on Submit. Once the checker is done analyzing your site’s SSL configuration, it will present you with some results:

On this page, you can find out if your certificate is still valid and see if it has been revoked for any reason.

In either case, updating your SSL certificate should resolve the handshake error (and is vital for keeping your site and your WooCommerce store secure).

3. Configure Your Browser for the Latest SSL/TLS Protocol Support

Sometimes the best way to determine the root cause of an issue is by process of elimination. As we mentioned earlier, the SSL handshake failure can often occur due to a browser misconfiguration.

The quickest way to determine whether a particular browser is the problem is to try switching to a different one. This can at least help narrow down the problem. You may also try disabling any plugins and resetting your browser back to its default settings.

Another potential browser-related issue is a protocol mismatch. For example, if the server only supports TLS 1.2, but the browser is only configured for TLS 1.0 or TLS 1.1, there’s no mutually-supported protocol available. This will inevitably lead to an SSL handshake failure.

How you can check to see if this problem is occurring varies based on the browser you’re using. As an example, we’ll look at how the process works in Chrome. First, open your browser and go to Settings > Advanced. This will expand a number of menu options.

Under the System section, click on Open your computer’s proxy settings:

This will open up a new window. Next, select the Advanced tab. Under the Security section, check to see if the box next to Use TLS 1.2 is selected. If not, check that option:

It’s also recommended that you uncheck the boxes for SSL 2.0 and SSL 3.0.

The same applies to TLS 1.0 and TLS 1.1 since they are being phased out. When you’re done, click on the OK button, and check to see if the handshake error has been resolved.

Note that if you’re using Apple Safari or Mac OS there isn’t an option to enable or disable SSL protocols. TLS 1.2 is automatically enabled by default. If you’re using Linux, you can refer to the Red Hat guide on TLS hardening.

4. Verify That Your Server Is Properly Configured to Support SNI

It’s also possible that the SSL handshake failure is being caused by improper Server Name Indication (SNI) configuration. The SNI is what enables a web server to securely host several TLS certificates for one IP address.

Each website on a server has its own certificate. However, if the server isn’t SNI-enabled, that can result in an SSL handshake failure, because the server may not know which certificate to present.

There are a few ways to check and see whether a site requires SNI. One option is to use Qualys’ SSL Server Test, which we discussed in the previous section. Input your site’s domain name, and then click on the Submit button.

On the results page, look for a message that reads “This site works only in browsers with SNI support”:

Another approach for detecting if a server is using SNI is to browse the server names in the ‘ClientHello’ message. This is a more technical process, but it can offer a lot of information.

It involves checking the extended hello header for a ‘server_name’ field, to see if the correct certifications are presented.

If you’re familiar with using tools such as the OpenSSL toolkit and Wireshark, you might find this method preferable. You can use openssl s_client with and without the -servername option:

# without SNI
 $ openssl s_client -connect host:port 

 # use SNI
 $ openssl s_client -connect host:port -servername host

If you get two different certificates with the same name, it means that the SNI is supported and properly configured.

However, if the output in the returned certificates is different, or the call without SNI cannot establish an SSL connection, it indicates that SNI is required but not correctly configured. Resolving this issue may require switching to a dedicated IP address.

5. Make Sure the Cipher Suites Match

If you still haven’t been able to identify the cause of the SSL handshake failure, it might be due to a cipher suite mismatch. In case you’re unfamiliar with the term, ‘cipher suites’ refer to a set of algorithms, including ones for key exchange, bulk encryption, and message authentication code, that can be used for securing SSL and TLS network connections.

If the cipher suites that a server uses don’t support or match what’s used by Cloudflare, that can result in an “SSL Handshake Failed” error.

When it comes to figuring out whether there is a cipher suite mismatch, Qualys’ SSL Server Test proves yet again to be a useful tool.

When you input your domain and click on Submit, you’ll see a summary analysis page. You can find the cipher information under the Cipher Suites section:

You can use this page to discover which ciphers and protocols the server supports. You’ll want to look out for any that display the ‘weak’ status. In addition, this section also details the specific algorithms for the cipher suites.

To correct this issue, you can compare the results against what your browser supports by using the Qualys SSL/TLS Capabilities of Your Browser tool. For more extensive information and guidance about cipher suites, we also recommend checking out the ComodoSSLStore guide.

Confused by the ‘SSL Handshake Failed’ error message? This guide explains what it is and, most importantly, 5 ways to fix it 🙌Click to Tweet

Summary

One of the most perplexing yet common types of SSL-related problems is the “SSL Handshake Failed” error. Dealing with this error can be stressful since it has many potential causes, including both client- and server-side issues.

However, there are some reliable solutions you can use to identify the problem and resolve it. Here are five ways you can use to fix the SSL Handshake Failed error:

1. Update your system date and time.
2. Check to see if your SSL certificate is valid (and reissue it if necessary).
3. Configure your browser to support the latest TLS/SSL versions.
4. Verify that your server is properly configured to support SNI.
5. Make sure the cipher suites match.

Когда мы просматриваем Интернет в деловых, личных, образовательных или развлекательных целях, мы хотим, чтобы Интернет был быстрым. Несомненно, неприятно ждать долгое время загрузки страницы, которую мы просим, ​​поэтому были созданы некоторые очень полезные инструменты, которые позволяют нам иметь безопасная и быстрая навигация .

Независимо от нашего интернет-провайдера или пакета, который мы арендуем, есть способы улучшить скорость , например, есть так называемые DNS, то есть система доменных имен, которые необходимо для подключения . Обычно это предоставляется оператором, которого вы нанимаете для предоставления интернет-услуг.

DNS превращает веб-адрес в IP-адрес , чтобы вы могли найти сервер с запрошенной информацией. Есть также публичные DNS-провайдеры. , хотя они немного медленнее из-за большого количества пользователей, конечно, с правильным DNS вы можете ускорить поиск на нужных страницах и повысить свою защиту во время просмотра.

Использование этих DNS также приносит пользу тем, кто посещает Интернет-страницы со своего мобильного телефона, так как это возможно: изменить или использовать другой DNS на своем мобильном устройстве, будь то Android или iOS .

Но не только DNS важен для быстрого просмотра и безопасно , также необходимо использовать так называемые CDN. По всему миру была создана сеть серверов, позволяющая хранить и тиражировать веб-страницы и информацию. Эти серверы, называемые CDN, позволяют нам приблизиться к нужным веб-сайтам, тем самым сокращая время отклика.

Как многие из вас уже знают, подключение к Интернету в основном связано с подключением одного компьютера к другому до тех пор, пока не будет создана сеть. По этой причине, чтобы иметь возможность подключиться к более высокая скорость с конкретным сервером, это Необходимо быть рядом с ним, что привело к созданию серверов во всех частях мира, способных повторять веб-сайты.

Таким образом, скорость соединений может быть увеличена за счет размещения серверов рядом с веб-страницами, которые мы посещаем. Эти так называемый CDN несомненно улучшили скорость и возможность доступа к различным веб-сайтам, конечно, всегда есть вещи, которые следует учитывать при просмотре Интернета и неудобства, которые возникают при использовании этих серверов.

Несколько лет назад был создан CloudFlare, чтобы решить некоторые проблемы и улучшить распространение контента. Кроме того, это помогло защитить нас от кибератак, сделав его одним из самых безопасных.

Выступая в качестве посредника для обратных прокси, он позволяет нам обнаруживать вредоносный трафик и спам в Интернете, что также обеспечивает защиту наших личных данных, особенно финансовых данных, которые часто подвергаются атакам.

Иногда при использовании сервера CloudFlare могут возникать проблемы, связанные с вашей инфраструктурой, но их можно решить. На этот раз поговорим в частности ошибка 525 « Ошибка протокола привязки SSL и как ее легко исправить с помощью этих советов.

Решение ошибки 525 ‘Ошибка согласования SSL

Для всех возможные сбои, возникающие при использовании CloudFlare, Есть определенные шаги, которые необходимо предпринять для их решения, в этом случае, если возникает ошибка подключения: ошибка 525 ‘Ошибка установления связи SSL.

Это происходит из-за ошибки конфигурации на веб-сервере, к которому вы пытаетесь подключиться; Есть два конкретных условия, которые должны быть выполнены для возникновения этой ошибки, одно из них — упомянутое нами.

Чтобы ошибка «SSL-согласование не удалось , что вам нужно сделать, это связаться с хостинг-провайдером. Чтобы определить, связана ли причина с распространенными ошибками на исходных веб-страницах.

Проверьте установленный SSL, порт 433 или другую защиту , Поддержка SNI и комплекты шифров; Таким образом можно определить источник сбоя и приступить к реализации необходимого решения проблемы. Точно так же в CloudFlare, они готовы дать вам нужный совет вам нужна эта проблема или, может быть, другая проблема, с которой вы столкнулись.

I have a problem with my website (and host).
I am using full(strict) crypto setting for my website. And I don’t know why it is encountering error since last month the web just work fine.

Here is the debug

Using curl -sv -o command :

curl -sv -o /dev/null https://<domain>.com/ --resolve <domain>.com:<<port>>:<<ip>>

* Added <domain>.com:<<port>>:<<ip>> to DNS cache
* Hostname <domain>.com was found in DNS cache
*   Trying <<vps_ip>>...
* TCP_NODELAY set
* Connected to <domain>.com (<<vps_ip>>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /usr/local/etc/openssl/cert.pem
  CApath: /usr/local/etc/openssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* stopped the pause stream!
* Closing connection 0

Using openssl s_client command :

openssl s_client -connect <<vps_ip>>:443 | openssl x509 -text -noout

52457:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/ssl/s23_clnt.c:618: unable to load certificate

52458:error:0906D06C:PEM routines:PEM_read_bio:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE

And here is the VHost config :

Listen 80
<VirtualHost *:80>
    ServerName <domain>
    ServerAlias <alias>
    ServerAdmin -alreadyset-
    DocumentRoot -alreadyset-

    SSLEngine      off
    SSLCertificateFile        -alreadyset-/mikata.pem
    SSLCertificateKeyFile     -alreadyset-/mikata.key

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    <Directory /home/emtetour/public_html>
        Options Indexes FollowSymLinks Multiviews
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    ErrorLog -alreadyset-
    CustomLog -alreadyset-

</VirtualHost>

Listen 443
<VirtualHost *:443>
    ServerName <domain>
    ServerAlias <alias>
    ServerAdmin -alreadyset-
    DocumentRoot -alreadyset-

    SSLEngine      on
    SSLCertificateFile        -alreadyset-/mikata.pem
    SSLCertificateKeyFile     -alreadyset-/mikata.key

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    <Directory /<directory>/public_html>
        Options Indexes FollowSymLinks Multiviews
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

</VirtualHost>

Anybody can help me? It’s already 4 days and I have no clue what to fix…
Thanks..

P.S.
The Server is running Apache2.4.25 with UbuntuOS. Cipher and protocol is compatible with cloudflare SSL.

Found the solution

This is probably a very late edit, but apparently Apache need a default VirtualHost settings for 443 port.

So you must add somethings like 111-default.conf then only write server admin, document root, and the SSL config (since mine is a wild-certificate, I used the same config as the website).

Hope this is helpful for others who encounter similar problem.

I have a problem with my website (and host).
I am using full(strict) crypto setting for my website. And I don’t know why it is encountering error since last month the web just work fine.

Here is the debug

Using curl -sv -o command :

curl -sv -o /dev/null https://<domain>.com/ --resolve <domain>.com:<<port>>:<<ip>>

* Added <domain>.com:<<port>>:<<ip>> to DNS cache
* Hostname <domain>.com was found in DNS cache
*   Trying <<vps_ip>>...
* TCP_NODELAY set
* Connected to <domain>.com (<<vps_ip>>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /usr/local/etc/openssl/cert.pem
  CApath: /usr/local/etc/openssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* stopped the pause stream!
* Closing connection 0

Using openssl s_client command :

openssl s_client -connect <<vps_ip>>:443 | openssl x509 -text -noout

52457:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/ssl/s23_clnt.c:618: unable to load certificate

52458:error:0906D06C:PEM routines:PEM_read_bio:no start line:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/pem/pem_lib.c:648:Expecting: TRUSTED CERTIFICATE

And here is the VHost config :

Listen 80
<VirtualHost *:80>
    ServerName <domain>
    ServerAlias <alias>
    ServerAdmin -alreadyset-
    DocumentRoot -alreadyset-

    SSLEngine      off
    SSLCertificateFile        -alreadyset-/mikata.pem
    SSLCertificateKeyFile     -alreadyset-/mikata.key

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    <Directory /home/emtetour/public_html>
        Options Indexes FollowSymLinks Multiviews
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    ErrorLog -alreadyset-
    CustomLog -alreadyset-

</VirtualHost>

Listen 443
<VirtualHost *:443>
    ServerName <domain>
    ServerAlias <alias>
    ServerAdmin -alreadyset-
    DocumentRoot -alreadyset-

    SSLEngine      on
    SSLCertificateFile        -alreadyset-/mikata.pem
    SSLCertificateKeyFile     -alreadyset-/mikata.key

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

    <Directory /<directory>/public_html>
        Options Indexes FollowSymLinks Multiviews
        AllowOverride None
        Order allow,deny
        Allow from all
        Require all granted
    </Directory>

</VirtualHost>

Anybody can help me? It’s already 4 days and I have no clue what to fix…
Thanks..

P.S.
The Server is running Apache2.4.25 with UbuntuOS. Cipher and protocol is compatible with cloudflare SSL.

Found the solution

This is probably a very late edit, but apparently Apache need a default VirtualHost settings for 443 port.

So you must add somethings like 111-default.conf then only write server admin, document root, and the SSL config (since mine is a wild-certificate, I used the same config as the website).

Hope this is helpful for others who encounter similar problem.

В этой статье опишем наиболее часто встречающиеся серверные ошибки 5хх. Для wordpress сайта это так же актуально, как и для всех прочих движков.

Ввиду обширности информации в данной статье будут описаны только возможные причины, приводящие к проблемам, но не способы их устранения, хотя эти способы в большинстве случаев вытекают из причин.

Некоторые ошибки можно видеть довольно часто, а другие (начиная примерно с 505) вы, возможно, никогда не встретите. В некоторых случаях они носят скорее экспериментальный характер.

500 Internal Server Error – внутренняя ошибка сервера

Это самая распространенная ошибка, возникающая при работе интернет-сайтов. Данный http код генерируется при любой проблеме, не входящей в рамки остальных ошибок. Учитывая это, к данной проблеме могут приводить множество причин.

Наиболее частые причины возникновения

Ошибка в коде. Самый простой пример, если вы в php коде забыли поставить ‘;’ после команды, это, вероятно, приведет к проблеме. Точно так же могут возникать ошибки при работе плагинов после их обновления, если конфигурация сервера не поддерживает какие-то вновь появившиеся в них команды.

Кстати, возникающие 500 ошибки записываются в лог сервера, и вы можете его посмотреть, чтобы диагностировать причину. Лог ошибок формируется практически на любом хостинге, но в некоторых случаях вам нужно включить логирование в своем кабинете хостинга.

Кроме того, к ошибке 500 могут привести причины:

1. неправильно выставленные права на файлы и папки;
2. неверные директивы, указанные в файле .htaccess;
3. скрипт долго выполняется (превышено время ожидания);
4. нехватка оперативной памяти сервера для выполнения скрипта.

Как избавиться от этой ошибки вы можете прочитать в отдельной статье о http error 500.

501 Not Implemented – не реализовано

Сервер не поддерживает возможностей, которые нужны для обработки запроса. То есть сервер не может выполнить http запрос, полученный от клиента из-за ограничений функционала.

Возможные причины

• Вредоносная программа или вирус перехватила контроль или повредила ваш интернет-браузер.
• В реестре Windows произошло повреждение из-за изменения программного обеспечения, связанного с Windows, например, установка или удаление программы.

502 Bad Gateway — ошибка шлюза

Это означает, что сервер, выступая в роли шлюза или прокси-сервера, получил недопустимый ответ от следующего в цепочке запросов сервера (вышестоящего сервера). По моей практике такое частенько происходит, когда ваш сервер перегружен.

503 Service Unavailable – сервис недоступен

Сервер временно не может техническим причинам обрабатывать запросы. Это может происходить из-за режима обслуживания или перегрузок сервера. При этом вместе с кодом ошибки может отображаться значение Retry-After с указанием времени, через которое клиенту рекомендуется повторить запрос (если сервер знает время задержки).

504 Gateway Timeout — истекло время ожидания

Означает, что сервер в роли прокси-сервера или шлюза не дождался ответа от следующего сервера для завершения запроса.

505 HTTP Version Not Supported — версия http не поддерживается

Сервер не поддерживает указанную в запросе версию протокола HTTP.

506 Variant Also Negotiates — вариант тоже проводит согласование

Выбранный вариант в результате ошибочной конфигурации указывает сам на себя, из-за чего процесс связывания прерывается.

507 Insufficient Storage — переполнение хранилища

Для выполнения текущего запроса не хватает места.

509 Bandwidth Limit Exceeded — исчерпана пропускная ширина канала

Возникает, если хостинг-провайдер установил ограничение на потребление трафика веб-площадкой и оно исчерпано.

510 Not Extended — не расширено

Клиент желает использовать расширение, которое отсутствует на сервере.

511 Network Authentication Required — требуется сетевая аутентификация

Этот ответ посылается сервером провайдера в случае, если клиент должен сначала авторизоваться в сети, например, ввести пароль для платной точки доступа к интернету.

520 Unknown Error — неизвестная ошибка

Возникает когда сервер CDN (Сеть доставки и дистрибуции содержимого) не смог обработать ошибку веб-сервера, нестандартный код CloudFlare (американская компания, предоставляющая услуги CDN).

521 Web Server Is Down — веб-сервер не работает

Ошибка возникает, когда подключения CDN отклоняются веб-сервером; нестандартный код CloudFlare.

522 Connection Timed Out — соединение не отвечает

Возникает, когда CDN не удалось подключиться к веб-серверу; нестандартный код CloudFlare.

523 Origin Is Unreachable — источник недоступен

Веб-сервер недостижим; нестандартный код CloudFlare.

524 A Timeout Occurred — время ожидания истекло

Истечение таймаута подключения между сервером CDN и веб-сервером; нестандартный код CloudFlare.

525 SSL Handshake Failed – квитирование SSL не удалось

Ошибка рукопожатия SSL между сервером CDN и веб-сервером; нестандартный код CloudFlare.

526 Invalid SSL Certificate — недействительный сертификат SSL

Не удаётся подтвердить сертификат шифрования веб-сервера; нестандартный код CloudFlare.