LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Ssl_error_rx_record_too_long (https://www.linuxquestions.org/questions/linux-security-4/ssl_error_rx_record_too_long-4175577995/)

vincix 04-21-2016 02:31 AM
Ssl_error_rx_record_too_long
 
Hi,

I'm trying to configure a https redirection for my website. I'm using Apache on an OpenSUSE 13.2. The structure of the config files is a little bit different from Centos, which I'm more familiar with, and I'm not sure how it all works, even though I understand that all directives are taken into consideration, as long as there's an include directive in the main config (httpd.conf)

The error is: Secure Connection Failed. An error occurred during a connection to mydomain.com. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

What I did first was simply to add these 3 lines (which work fine on my Centos 7):
Code:
<VirtualHost *:80>
redirect / https://mydomain.com/
</VirtualHost>
I've already configured a letsencrypt certificate, and the result was successful. The files have been created in /etc/letsencrypt/live/mydomain.com/

So I edited ssl-global.conf and added these lines:
Code:
SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/chain.pem
The server is listening both on 80 and 443 ports. I actually wrote Listen 0.0.0.0:443, as netstat was showing that the server was listening on IPv6.



I've already added a <VirtualHost *:443> container in ssl-global.conf, in which the SSLCertificate directives are included, even though I don't think it's necessary to place them within the container.

Any ideas how I'm supposed to attack this problem? Should I offer more information?

P.S. I forgot to mention that I'm using it for owncloud. The weird thing is that if I type in mydomain.com, it doesn't redirect to https, but when I write mydomain.com/owncloud, then it redirects to https and it gives the aforementioned error.

bathory 04-21-2016 04:20 AM
Quote:
The error is: Secure Connection Failed. An error occurred during a connection to mydomain.com. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG
The above error means that apache listens on port 443, but it uses the plain http protocol, i.e. SSL is not enabled.
I'm not a Suse user, so better have a look here (skip the initial certificates stuff since you have the certs), about the apache configuration files that need editing.

Regards

Habitual 04-21-2016 04:42 AM
Doesn't owncloud have an "Use ssl" option in the admin area?

vincix 04-21-2016 09:48 AM
Quote:
Originally Posted by Habitual (Post 5534433)
Doesn't owncloud have an "Use ssl" option in the admin area?
It actually has an 'enforce ssl' option, which is greyed out. Probably because it hasn't identified proper settings for https.

I followed the instructions, but to no avail. I'm not trying to redirect anymore, so that others can use owncloud in the meantime. I'm testing it by prefixing https in the address bar.

The error is the same.

These are my include directives in httpd.conf (I bolded the one I think is relevant):
Code:
Include /etc/apache2/uid.conf
Include /etc/apache2/server-tuning.conf
Include /etc/apache2/sysconfig.d/loadmodule.conf
Include /etc/apache2/listen.conf
Include /etc/apache2/mod_log_config.conf
Include /etc/apache2/sysconfig.d/global.conf
Include /etc/apache2/mod_status.conf
Include /etc/apache2/mod_info.conf
Include /etc/apache2/mod_usertrack.conf
Include /etc/apache2/mod_autoindex-defaults.conf
Include /etc/apache2/mod_mime-defaults.conf
Include /etc/apache2/errors.conf
Include /etc/apache2/default-server.conf
Include /etc/apache2/sysconfig.d/include.conf
And these are the directives in default-server.conf:
Code:
IncludeOptional /etc/apache2/conf.d/*.conf
IncludeOptional /etc/apache2/conf.d/apache2-manual?conf
Include /etc/apache2/vhosts.d/*.conf
Include /etc/apache2/conf.d/*.conf (here there's owncloud, phpmyadmin)
So I configured https in /etc/apache2/vhosts.d/vhost-ssl.conf:
Code:
<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost *:443>
        DocumentRoot "/srv/www/htdocs"
        ErrorLog /var/log/apache2/error_log
        TransferLog /var/log/apache2/access_log
        SSLProtocol all -SSLv2
        SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/mydomain.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/mydomain.com/chain.pem
        CustomLog /var/log/apache2/ssl_request_log  ssl_combined
</VirtualHost>
</IfDefine>
</IfDefine>

Habitual 04-21-2016 10:53 AM
Did you run
Code:
a2enmod ssl
some time during this task?

Seen http://refugeeks.com/owncloud-setup-guide/ ?

vincix 04-21-2016 11:16 AM
Quote:
Originally Posted by Habitual (Post 5534596)
Did you run
Code:
a2enmod ssl
some time during this task?

Seen http://refugeeks.com/owncloud-setup-guide/ ?

a2enmod ssl
"ssl" already present

First I need to solve the https problem. When I try https://mydomain.com, the error is the same. So it's not related to owncloud, at least not at this stage. SSL is not working, and it's related to Apache, not to owncloud.

Habitual 04-21-2016 11:33 AM
http://refugeeks.com/owncloud-setup-...figuring-HTTPS is fairly Apache-specific.

bathory 04-21-2016 12:04 PM
Quote:
Originally Posted by vincix (Post 5534606)
a2enmod ssl
"ssl" already present

First I need to solve the https problem. When I try https://mydomain.com, the error is the same. So it's not related to owncloud, at least not at this stage. SSL is not working, and it's related to Apache, not to owncloud.
From the link in my previous post, you may need to also do the following (at least the 2nd one):
Quote:
Edit the /etc/sysconfig/apache2 file.

APACHE_START_TIMEOUT="10"
APACHE_SERVER_FLAGS="SSL"

vincix 04-21-2016 12:25 PM
Quote:
Originally Posted by bathory (Post 5534625)
From the link in my previous post, you may need to also do the following (at least the 2nd one):
I completely missed that. This is a big step forward. Now I can see finally that Apache is actually reading vhost-ssl.conf! But now the problem is that several directives which seem completely legitimate are interpreted as invalid.
Code:
Invalid command 'SSLCipherSuite', perhaps misspelled or defined by a mo...
Invalid command 'SSLEngine', perhaps misspelled or defined by a module...
Invalid command 'SSLEngine', perhaps misspelled or defined by a module...
Invalid command 'SSLCertificateFile', perhaps misspelled or defined by...
Invalid command 'SSLCertificateFile', perhaps misspelled or defined by...
And so on, and so forth. Any ideas why it would do that?

vincix 04-21-2016 12:34 PM
Following habitual's link, I had enabled an "owncloud-ssl" module (which didn't exist on my machine anyway) and disabled ssl. That's where the errors came from and that's why apache was seeing legitimate directives as invalid. Then I enabled ssl and disabled owncloud-ssl again.

After enabling SSL in /etc/sysconfig/apache2, ssl_request_log has also been generated under /var/log.

Even so, when I try https://mydomain.com(/owncloud), I get the same error.

vincix 04-21-2016 12:43 PM
Quote:
Originally Posted by vincix (Post 5534640)
Following habitual's link, I had enabled an "owncloud-ssl" module (which didn't exist on my machine anyway) and disabled ssl. That's where the errors came from and that's why apache was seeing legitimate directives as invalid. Then I enabled ssl and disabled owncloud-ssl again.

After enabling SSL in /etc/sysconfig/apache2, ssl_request_log has also been generated under /var/log.

Even so, when I try https://mydomain.com(/owncloud), I get the same error.

Later edit:
I changed the Virtualhost directive from mydomain.com to *:443 and ssl seems to be working. The letsencrypt certificate is recognized by the browser. The only problem now is that I get a 403 forbiden error when prefixing with https, both with or without /owncloud.

Unbelievable! It works. The problem was that <Directory "/srv/www/htdocs"> was included in the <VirtualHost *:80>. I placed it outside and it works!

Thanks to both of you. You've been really helpful :) But the /etc/sysconfig/apache2 proved to be essential. It never crossed my mind, of course, because it doesn't exist in CentOS. A rather sad inconsistency between linux distros which made me spent a whole day on this... but I guess it was worth it in the end :)

Habitual 04-21-2016 01:27 PM
Glad it worked out.
FWIW: I have never touched any /etc/sysconfig/apache2 getting all my https working.
httpd on CentOS and httpd on Ubuntu are not the same thing, as you have found out.

vincix 04-21-2016 02:53 PM
Quote:
Originally Posted by Habitual (Post 5534672)
Glad it worked out.
FWIW: I have never touched any /etc/sysconfig/apache2 getting all my https working.
httpd on CentOS and httpd on Ubuntu are not the same thing, as you have found out.
I had also asked a very knowledgeable person, but he couldn't come up with this solution. He was thinking of tinkering with the VirtualHost directive and so on, and so forth. So yeah. I don't like using too many distros, I'd prefer using only Centos/Redhat, but it can't be helped in this case.

Habitual 04-21-2016 03:33 PM
I used https://www.digitalocean.com/communi...r-ubuntu-12-04
before I had Owncloud EE and that has it's own SSL chain built-in, I believe.

vincix 04-23-2016 07:18 AM
Quote:
Originally Posted by Habitual (Post 5534732)
I used https://www.digitalocean.com/communi...r-ubuntu-12-04
before I had Owncloud EE and that has its:) own SSL chain built-in, I believe.
What did you use owncloud EE for?


All times are GMT -5. The time now is 04:40 PM.