Ssl error rx record too long apache2

Troubled by seeing Apache ssl_error_rx_record_too_long on your website? You are not alone!

This error frequently occurs when SSL traffic is not set up properly on the target secure server.

At Bobcares, we often get requests from our customers regarding the Apache SSL certificate error as part of our Server Management Services.

Today, we’ll see how our Support Engineers find fix for our customers.

What are the causes of Apache ssl_error_rx_record_too_long?

Everyone wants their websites to be secure. But, improper implementation of security often results in errors like Apache ssl_error_rx_record_too_long.

Some possible causes for this error are:

• SSL traffic is not set up properly on the target server.
• DNS may not be correct in the DNS name on VirtualHost.
• Misconfigured proxy not allowing an SSL handshake on port 443 correctly.

But, how to fix this problem is the main question. Being in the hosting industry for more than a decade, we see many variants of SSL error. Let’s see how our Engineers handle this error in different scenarios.

What are the Fixes?

In simple terms, the fix for the SSL error involves handling the secure traffic reaching the server correctly. We’ll now take a look at the exact steps involved.

When a customer approaches us with Apache ssl_error_rx_record_too_long error, our Support Engineers initially replicate the error from our side. This eliminates any possible browser errors at the user’s computer.

We then proceed with the following actions:

1. We make sure that SSL is running on port 443. Because if SSL is running on a non-standard port, then Firefox may show this error.

netstat -lpan | grep :443

We do this by adding the following in the Apache configuration httpd.conf file.

Listen 443

2. Upon finding the correct port settings, we check and confirm that the SSL certificate is valid and not expired.

Also, we make sure not more than one SSL is sharing the same IP.

3. On IPv6, our Engineers include the IP Address for eliminating this error.

Listen x.x.x.x:443

4. Similarly, when customers get this error on Windows, we check whether the host file on the Windows server is properly set.

If not, we do it by changing VirtualHost domain.com:443 to VirtualHost _default_:443.

Each server configuration differs and so the troubleshooting will not be identical. However, we check the path of the SSL traffic and make corrections. This solves the problem and makes the SSL version of the website working again.

[Having trouble with Apache SSL error? We’ll fix it for you.]

Conclusion

In short, we discussed in detail on possible causes and fixes for Apache ssl_error_rx_record_too_long error. Also, we saw the way by which our Support Engineers find the fix for this error.

var google_conversion_label = «owonCMyG5nEQ0aD71QM»;

Добрый день. Пытаюсь настроить хост через ssl. Вроде все элементарно просто, но что то не получается. Изначальный мануал брал тут

Файл хоста:

#<IfDefine SSL>
#<IfModule !mod_ssl.c>
#LoadModule ssl_module modules/mod_ssl.so
#</IfModule>
#<IfModule mod_ssl.c>
<VirtualHost xxx.xxx.xxx.xxx:443>
ServerAdmin info@site.su
ServerName myssl.site.su
DocumentRoot /var/www/site.su/myssl/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/site.su/myssl/>
            SSLRequire
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>

Если раскомментировать строки IfModule и IfDefine то apache стартует без ошибок, но при попытке доступа к хосту браузер пишет:

Ошибка при установлении защищённого соединения

При соединении с myssl.site.su произошла ошибка. SSL получило запись, длина которой превышает максимально допустимую. (Код ошибки: ssl_error_rx_record_too_long)

Строки:

#SSLCertificateFile    /etc/apache2/ssl/apache.pem
        #SSLCertificateKeyFile /etc/apache2/ssl/apache.keyвнесены мной вместо тех что используются выше. С ними браузер выдает ту же ошибку.
Браузер в любом случае выдает эту ошибку (
В логах apache при текущем конфиге пишет вот что:

[notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.18 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations
Подскажите, пожалуйста, куда смотреть?

Пользователь решил продолжить мысль [time]17 Июнь 2015, 11:49:04[/time]:

Посмотрел эту статью. Поправил конфиг хоста и убрал из него все лишнее:

<VirtualHost xxx.xxx.xxx.xxx:443>
ServerAdmin info@site.su
ServerName myssl.site.su
DocumentRoot /var/www/site.su/myssl/
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/site.su/myssl/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>

Ошибка в логе apache:

[error] VirtualHost xxx.xxx.xxx.xxx:443 -- mixing * ports and non-* ports with a NameVirtualHost address is not supported, proceeding with undefined results
[Wed Jun 17 10:40:26 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Jun 17 10:40:26 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.18 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1 configured -- resuming normal operations

Пользователь решил продолжить мысль [time]17 Июнь 2015, 16:25:16[/time]:

В общем победил.
Оказывается чтоб оно корректно работало, нужно в каждом файле хоста прописать вместо

<VirtualHost xxx.xxx.xxx.xxx:443>
и
<VirtualHost xxx.xxx.xxx.xxx:80>это

<VirtualHost *:443>
и
<VirtualHost *:80>
Все заработало.

In this post, we provide 6 fixes for the “ssl_error_rx_record_too_long” error.

When you use FireFox, there might be some instances that you’ll come across an error. One of them is the “ssl_error_rx_record_too_long” error. In this article, we’re going to go through the nature of this error, what causes it, and what are the possible fixes you can use.

Anyone else seeing this error on Blogspot?

SSL_ERROR_RX_RECORD_TOO_LONG pic.twitter.com/lcj5j4MB2V

— Terence Eden (@edent) November 29, 2016

If you use the latest Microsoft OS versions (e.g. Windows 7, 8, and 10), then there will be instances where you can come across the ssl_error_rx_record_too_long FireFox error.

This error appears when you connect to a website that has an HTTPS protocol using the FireFox browser and the secure connection fails. The problem, however, is that it can be tricky to figure out the exact cause of the problem. There are various factors including:

• Protocol issues
• Browser issues
• Security settings
• Software conflicts

If you’re not tech-savvy, this might sound alarming to you. Fortunately, this problem can be easily fixed by following the fixes mentioned below.

How to Fix the ssl_error_rx_record_too_long Error?

If you find the ssl_error_rx_record_too_long error recurring, then you need to fix it immediately. Here are the following fixes you can follow:

1st Fix: Change the Connection to HTTP Protocol

The very first fix you should try is to connect to the website without the secure protocol. According to Auslogics, the changes are done to the URL so as to bypass a secure connection. To achieve this, you have to follow these steps:

1. Open the site with the ssl_error_rx_record_too_long error
2. On the address bar, change https:// to http://
3. After that, simply reload the page by either clicking on the Refresh icon or pressing the F5 button.

2nd Fix: Update Your Browser

According to Auslogics, your Firefox browser may fail to update itself automatically in accordance with the default settings. Hence it needs to be updated manually, as this may be causing the ssl_error_rx_record_too_long error. Here’s how:

1. Open or launch your Firebox browser.
2. Head to the upper right corner and look for the Menu icon. Click on it.
3. After that, click Help then choose About Firefox from the drop-down.
4. This will take you to the browser’s version screen. If your browser is currently outdated, simply update it.

Once you have updated the browser, restart it and check if the problem is fixed. If not, you might want to proceed to the next fix.

3rd Fix: Check Your Browser’s Proxy Settings

Windows Report suggests that the proxy connection might be the cause of the error, and as such recommends that you check its settings. However, there are no specific steps for this. Additionally, the HashedOut blog recommends that you shouldn’t attempt to configure the proxy on your own unless you’re an IT admin, as a misconfigured proxy setting can only lead to more problems.

Video Guide: How To Change Proxy Settings In Google Chrome

4th Fix: Start in Safe Mode

Safe mode can help fix several errors associated with your browser. This means that even the ssl_error_rx_record_too_long error can be solved by activating Firefox’s safe mode. As a matter of fact, the safe mode switches off all add-ons and extensions for a short time before turning back to default. To go to safe mode, follow the steps below as outlined by UGetFix:

1. On your Firefox browser, click Open Menu then look for Help.
2. From the drop-down list, click Restart with Add-ons Disabled then click Restart.
3. Press Start in Safe Mode from the dialogue window that appears.
4. After that, check whether the error has been resolved.

Video Guide: Open Google Chrome In Safe Mode

5th Fix: Disable All Add-ons

If the previous fix worked for you, then there’s no longer a need to fix it anymore. However, chances are you’ll still encounter the error when you open the website on a normal browser, and one of the probable cause of this is add-ons.

Add-ons are known to be important, but sometimes, they can also be the cause of the ssl_error_rx_record_too_long error. Thus, they need to be disabled. Here are the steps outlined by Windows Report:

• While still on Safe mode, click on the Menu button.
• Press the Help button from the drop-down menu then choose Restart with Add-ons Enabled.
• After that, in Firefox’s address bar, simply type about:addons then hit Enter.
• Click Disable for each of the add-ons you have added.
• Restart Firefox then visit the website again.

Video Guide: Disabling Chrome Extensions

6th Fix: Disable Your Antivirus Temporarily

In some cases, your antivirus may interpret some SSL certificates as a threat to your browsing activities. Hence, it will block any data from the page. This may be the reason behind the ssl_error_rx_record_too_long error. By disabling your antivirus, you can probably fix this issue.

If you are using a third-party antivirus, it’s best to check its manual so you can disable it. If you are using Microsoft’s Windows Defender, here are how you can do it as what Auslogics suggested (steps will vary depending on your OS version):

Windows 10:

1. Press the Windows key or simply click on Start Menu.
2. Look for the Gear icon to open the Settings page.
3. On the Settings page, click Update and Security.
4. Go to Windows Security.
5. Select Virus and threat protection. Go to its settings.
6. Scroll down to the Real-time protection option then switch it off.

Window 8:

1. Navigate to the Start menu then look for the Control Panel.
2. Enable the Icons view on your Control Panel.
3. Look for the Window Defender icon and click on it.
4. Head to Settings.
5. On the left side, click on Real-time protection then turn it off by unchecking the box.
6. Save the changes afterward.

Window 7:

1. Go to your Control Panel from the Start menu.
2. Click on the Control Panel and enable the Icons view.
3. Click on the Windows Defender icon.
4. Head to the Tools section then look for Options.
5. On the left pane, click on Real-time Turn it off by unchecking the box next to it.
6. Save your settings then exit.

Video Guide: How To Disable Or Enable Windows Defender In Windows 10

Forum Feedback

We looked through different tech forums and support board to find more about the ssl_error_rx_record_too_long message and the problems users have with it. In general, people wanted to know about ssl_error_rx_record_too_long Firefox fix, ssl_error_rx_record_too_long Apache, and ssl_error_rx_record_too_long debian 9. They were also interested in ssl_error_rx_record_too_long Chrome and letsencrypt.

A site owner reported that users couldn’t access the website and that they kept getting the message that ssl_error_rx_record_too_long on all browsers and platforms.

• After he did some research on the subject, he discovered that this error was caused by an incorrect implementation of the SSL on the server side.
• The solution was to check if he had opened and enabled the 443 port on the server.
• He also recommended that you check your vhost config if you’re using Apache2 and that your SSL certificate hadn’t expired.

Another person said that the only thing that solved the ssl_error_rx_record_too_long error was to reinstall the SSL. He also mentioned that you should recheck the SSL configuration to see if you had set the SSLEngine on.

An individual shared that you might get the ssl_error_rx_record_too_long error when the SSL port was speaking in HTTP. The user also commented that the problem could be related to the user’s proxy configuration and that the problem might not be on the server-side at all.

Another computer owner commented that he had problems opening his site using Firefox, but it was working well in Chrome. In Firefox he was getting the ssl_error_rx_record_too_long error, and he was wondering if the issue was related to the SSL certificate or it was a Firefox bug.

A computer expert explains that ssl_error_rx_record_too_long occurs when you haven’t configured a certificate properly on the server’s port. The port is opened to the server, but since the configuration is not correct, users can’t access the website. The person adds that it’s an error that you are likely to encounter in web servers like Apache and Nginx.

Another individual shared that he encountered the ssl_error_rx_record_too_long problem in Apache and that he spent a lot of time researching how to fix it. Finally, he realized that it was related to an issue with the VirtualHost record because he didn’t have a VirtualHost record for the 433 port.

A person pointed out that if you’re a regular user and you can’t access a website because of the ssl_error_rx_record_too_long, you should contact the website’s owner and notify him of the problem.

• The individual states that you can do little on your part to fix the problem because it’s almost always on the server-side.
• What’s more, he warned that turning off your antivirus or switching to HTTP to bypass the issue was dangerous and probably would compromise the security of your online communications.

Another forum poster observes that ssl_error_rx_record_too_long is usually the result of two things – misconfiguration of the listening port or issues with the TSL version. The user recommends that you update your SL/TLS library if you haven’t already done it and that you check that you’re not supporting TLS 1.0 and SSL 3.0.

Another poster pointed out that using an irregular port or not having a trusted certificate would also result in a ssl_error_rx_record_too_long error and that the configuration of the port will depend on the type of server. In addition to this, he advised that you check your certificate once more to ensure that it’s working properly.

A person commented that he was getting the ssl_error_rx_record_too_long error when he was visiting different websites.

• The computer user added that reloading the page sometimes worked but other times didn’t.
• Since it was obvious that the problem was not on the server side, he was wondering what was wrong with his system.
• Other forum members advised him to clear the cache or attempt to load the page in an incognito window.
• They also said that he could write HTTPS before the URL and see if it would solve the problem.

Another user shares that if you’re using Tomcat, you should check if the connector is properly configured to use SSL and that the port number is correct. He also mentions that in Apache you should see if the Listen port matches the numbers in the VirtualHost directive.

An individual also says that you might experience the ssl_error_rx_record_too_long error if Firefox has enabled TLS 1.3 and the security software has an issue with it. You can fix that by going to typing about:config in the address bar and change the value as follows security.tls.version.max = 3.

Conclusion

One of the above fixes might work to resolve your the ssl_error_rx_record_too_long error. However, if nothing ever worked, the last option would be to reinstall your Firefox browser. It’s pretty straightforward, really. You just have to uninstall it from your programs list then download a fresh copy of the browser and install once again.

There are a few different SSL-related errors in Apache that can cause the following issues:

• SSL errors are reported in the log file causing Apache to not start
• Untrusted certificate warnings in browsers or intermediate certificate errors on DigiCert.com/help
• The browser error message «ssl_error_rx_record_too_long»

Errors That Keep Apache from Starting

Errors that keep Apache from starting can be very frustrating. This usually happens when Apache is reading the configuration files and finds something it doesn’t know how to handle.
The first step when you experience this issue is to check your log file for an error that might point to the problem.

The default location of the log files is as follows:

If the log files are not in the above location, you may have defined a different log file location in your httpd.conf file or the VirtualHost section of your .conf file.

Some possible conf file errors you may find are listed below.

«Unable to configure RSA server private key» and «certificate routines:X509_check_private_key:key values mismatch» Errors

If you see one of these errors it usually means that the private key that is being loaded in the VirtualHost section of your .conf file doesn’t match the SSL Certificate being loaded in the same section.

To check if the two files match, run the following OpenSSL command on each of them:

openssl x509 -noout -modulus -in your_domain_com.crt | openssl md5
openssl rsa -noout -modulus -in your_domain_com.key | openssl md5

If the modulus of the two files doesn’t match exactly, do one of the following:

1. Find the .key file matching your .crt file and update the VirtualHost in your .conf file to match.
2. Reissue your certificate by either generating two new files with the OpenSSL CSR Wizard
   or by creating a new CSR from your existing private key file using the following command.

   Note that the existing private key must be at least 2048 bits. If the key is less than 2048 bits you will have to recreate the key.

openssl req -new -key your_domain_com.key -out your_domain_com.csr

«Invalid command ‘SSLEngine'» Error

This error can be caused by mod_ssl not being installed on a server. This module is required by Apache to create SSL connections.

To enable this module on CentOS/RedHat Linux run the following command from the console:

sudo yum install mod_ssl

To enable this module on a Debian-based distro run the following command:

a2enmod ssl

«SSL3_READ_BYTES:sslv3 alert handshake failure» and «SSL23_WRITE:ssl handshake failure» Errors

These errors are caused by a directive in the configuration file that requires mutual authentication. For example, if an SSL Certificate is sent from the server and then a separate SSL Certificate is sent back from the client during the SSL handshake, this error will occur.

In our experience, this directive is usually included by accident. To remove the directive and thus fix the error, open your conf file. Change SSLVerifyClient or SSLVerifyClient optional_no_ca to SSLVerifyClient none, then restart Apache.
This change will tell the Apache server to stop looking for a client certificate when completing the SSL handshake with a client computer.

Another possible cause of these errors is including the line SSLVerifyDepth 1 in the conf file. Comment out the line by adding a # to the beginning (ex. #SSLVerifyDepth 1).

«SSLSessionCache: Invalid argument: size has to be >=8192 bytes» Error

This error happens when the name of the folder where Apache for Windows is installed includes spaces or parenthesis.

To fix this, move all of the files for Apache to a different folder (ex. c:/Program Files (x86)/Apache2/ to c:/Apache/Apache2/).

Alternatively, you can change the folder name to a short name. Run the following command to find the short name for the folder:

dir /x C:

You will also need to add a backslash () to avoid the ~ character as follows:
C:/Program Files (x86)/Apache2/ will change to C:/Progra~2/Apache2/

Finally, restart Apache.

Untrusted and Missing Intermediate Certificate Errors

Two things can cause this error in the SSL Certificate Tester:

1. The VirtualHost section of your .conf file (usually httpd-ssl.conf, ssl.conf, or virtual-host.conf) for SSLCertificateChainFile is either commented out (e.g. #SSLCertificateChainFile),
   or is pointing to the wrong SSL Intermediate Certificate file. To correct this, simply uncomment the line and make sure the SSLCertificateChain file points to DigiCertCA.crt.

2. The VirtualHost section of your .conf file is configured correctly but you already have a virtual host configured using a different .conf file for the IP address and port that you
   are trying to install the SSL Certificate to.
   The problem is usually that the other .conf file is pointing to the wrong SSL Intermediate Certificate file.

   To find this file, run a quick grep command (change /etc/apache2/ to your Apache home directory). This will search all of the subfolders in the current directory for a .conf file containing SSLCertificateChainFile.

   grep -i -r "SSLCertificateChainFile" /etc/apache2/

   On Windows use the following command:

   findstr /s /i "SSLCertificateChainFile" *.conf

Once you find the file, uncomment the line if it is commented out (remove the #) and make sure the SSLCertificateChain file points to DigiCertCA.crt. Then restart Apache.

«SSL received a record that exceeded the maximum permissible length, ssl_error_rx_record_too_long» Error

This error most commonly appears in Firefox browsers, but similar errors can appear in other browsers as well.
This error often occurs because SSL traffic is not set up correctly on the server that you are trying to secure. For example, the DNS is not correct in the DNS name on your VirtualHost.

Here are some ways to fix this error:

1. The file /conf/extra/httpd-ssl.conf was configured with the correct SSL information but isn’t being loaded because httpd.conf isn’t loading it.

   To fix this error, uncomment the following line (remove the #). Then restart Apache.

   #Include conf/extra/httpd-ssl.conf

2. Apache isn’t set to listen on port 443 for secure traffic. To fix this, add the following line before the <VirtualHost> block is loaded:

   Listen 443

   If you’re using IPv6 you’ll need to include the IP address as well as the port:

   Listen 192.168.0.1:443

   If you’re running https on a non-standard port you’ll need to tell Apache to listen for an SSL connection on that port:

   Listen 192.168.0.1:8443 https

   If you see the above inside of an <If DefineSSL> block, you need to make sure you are defining SSL when you start Apache. Normally SSL should be defined on its own,
   but if it isn’t being defined you can try the following commands for earlier versions of Apache 2:

   
path/to/httpd -D SSL -k start
path/to/apachectl startssl
path/to/httpd startssl


3. If you’re running Apache under Windows make sure the host file on the Windows server is set up correctly. It should be in C:WindowsSystem32Driversetchosts.
   Some people fix this error by changing VirtualHost your.domain.com:443 to VirtualHost _default_:443, etc.

4. Make sure in the <VirtualHost> block Apache is configured to use SSL with the SSLEngine directive as follows:

   <VirtualHost your.domain.com:443>
   SSLEngine On
   [rest of VirtualHost]
   </VirtualHost>

This error can also occur if you have a misconfigured proxy that doesn’t allow you to do an SSL handshake on port 443 correctly.
The way to test this is to try connecting to the site from outside of your network with a few different web browsers and see if you still receive the error. If you do not receive the error the proxy is probably misconfigured.

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com