Cloudflare Developers•14mo ago

Invalid SSL cert on subdomains

I have 4 domains pointed at the same origin, set up near identically on nginx and cloudflare however, 2 of the sites return a 526 error on exclusively the subdomains and I cannot for the life of me figure out why. All 4 are set to full (strict) encryption mode

53 Replies

Cyb3r-Jak3•14mo ago

What are the hosts on the certificate on the origin server?

WellardOP•14mo ago

functional site: https://pls-end.me/P7bOM6 non-functional site: https://pls-end.me/n5vctq

Cyb3r-Jak3•14mo ago

Are there any errors to certificates in the nginx logs?

WellardOP•14mo ago

just the stapling errors oh wait these are here

2023/10/07 00:29:47 [crit] 1525311#1525311: *1586 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 00:29:58 [crit] 1525311#1525311: *1587 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 00:59:58 [crit] 1525311#1525311: *1957 SSL_do_handshake() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while SSL handshaking, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 01:47:39 [crit] 1525311#1525311: *2536 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443

2023/10/07 00:29:47 [crit] 1525311#1525311: *1586 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 00:29:58 [crit] 1525311#1525311: *1587 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 00:59:58 [crit] 1525311#1525311: *1957 SSL_do_handshake() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while SSL handshaking, client: [REDACTED], server: 0.0.0.0:443
2023/10/07 01:47:39 [crit] 1525311#1525311: *2536 SSL_read() failed (SSL: error:0A000126:SSL routines::unexpected eof while reading) while keepalive, client: [REDACTED], server: 0.0.0.0:443

but they don't appear every time you try to visit a subdomain as far as I can see they might've been from a previous issue I wish it showed the host header

Cyb3r-Jak3•14mo ago

Are the clients Cloudflare IPs? It could be false noise from malformed https requests?

WellardOP•14mo ago

no they aren't it's just those annoying bots that scrape everything they can ig

Chaika•14mo ago

I would check what certificate it is serving directly: https://community.cloudflare.com/t/community-tip-fixing-error-526-invalid-ssl-certificates/44273 You can use a command like:

openssl s_client -connect 127.0.0.1:443 -servername broken.subdomain.com  -ign_eof -verify_return_error

openssl s_client -connect 127.0.0.1:443 -servername broken.subdomain.com  -ign_eof -verify_return_error

From the shell of the machine with the web server on it, check if it's serving the right certificate (the CN = value specifically

Cloudflare Community

Community Tip - Fixing Error 526: Invalid SSL certificates

Error Try the suggestions in this Community Tip to help you fix Error 526: Invalid SSL certificate. Background Error 526 indicates Cloudflare is unable to successfully validate the SSL certificate on the origin web server and the SSL setting in the Cloudflare SSL/TLS app is set to Full SSL (Strict) for the website. When this happens, you’ll s...

WellardOP•14mo ago

I trust this won't return anything sensitive and I can just upload to a paste site and send it here? I don't see any difference between a functional and broken domain

WellardOP•14mo ago

https://pastes.dev/pXQiMP3Eji

pastes | pXQiMP3Eji

A paste containing 54 lines of plaintext.

WellardOP•14mo ago

this is the broken one

Chaika•14mo ago

ah that's annoying, it's just upset because it can't verify the cert, since origin certs aren't trusted. If you change that end bit to -verify 1 instead of -verify_return_error, it'll just give you the public certificate under "Server Certificate", and you can pop that into a tool like https://www.sslshopper.com/certificate-decoder.html to ensure it's the right one being served

WellardOP•14mo ago

uh the command got stuck I had to ctrl+c it

Chaika•14mo ago

that's fine, just scroll up after there's probably a better way to do this, but the command the doc recommends using curl is only friendly to actually trusted certificates

WellardOP•14mo ago

do I paste the entire output or just the cert?

Chaika•14mo ago

just the cert, including -- begin cert -- and --end cert

WellardOP•14mo ago

https://pls-end.me/pe9Kz0

Chaika•14mo ago

oh that's your actual domain? I thought you were just trying to hide it lol

WellardOP•14mo ago

wait wrong domain

Chaika•14mo ago

and that's the broken one?

WellardOP•14mo ago

mb that's the fixed on e nah I actually own that lmao

Chaika•14mo ago

the real question is just which certificate it is serving for the one which doesn't work

WellardOP•14mo ago

oh wait no I did run the right command but it's actually returning the helpmeplea.se ssl cert

Chaika•14mo ago

and it's serving the wrong one? Well there you go, what's your nginx config look like?

WellardOP•14mo ago

server {
    listen              443 ssl http2;
    server_name         *.wellard.org, wellard.org;
    root                /v2/www;

    # SSL
    ssl_certificate     /etc/nginx/ssl/wellard.org.crt;
    ssl_certificate_key /etc/nginx/ssl/wellard.org.key;

    # security
#    include             nginxconfig.io/security.conf;

    # logging
    access_log          /var/log/nginx/access.log combined buffer=512k flush=1m;
    error_log           /var/log/nginx/error.log warn;

    # index.html fallback
    location / {
        try_files $uri.jpeg $uri.jpg $uri.png $uri.gif $uri.bmp $uri.ico $uri.svg $uri.tif $uri.tiff $uri.css $uri.js $uri.htm $uri.html $uri.ttf $uri.otf $uri.webp $uri.woff $uri.txt $uri.csv $uri.rtf $uri.doc $uri.docx $uri.xls $uri.xlsx $uri.ppt $uri.pptx $uri.odf $uri.odp $uri.>
    }

    # additional config
#    include nginxconfig.io/general.conf;
}

server {
    listen              443 ssl http2;
    server_name         *.wellard.org, wellard.org;
    root                /v2/www;

    # SSL
    ssl_certificate     /etc/nginx/ssl/wellard.org.crt;
    ssl_certificate_key /etc/nginx/ssl/wellard.org.key;

    # security
#    include             nginxconfig.io/security.conf;

    # logging
    access_log          /var/log/nginx/access.log combined buffer=512k flush=1m;
    error_log           /var/log/nginx/error.log warn;

    # index.html fallback
    location / {
        try_files $uri.jpeg $uri.jpg $uri.png $uri.gif $uri.bmp $uri.ico $uri.svg $uri.tif $uri.tiff $uri.css $uri.js $uri.htm $uri.html $uri.ttf $uri.otf $uri.webp $uri.woff $uri.txt $uri.csv $uri.rtf $uri.doc $uri.docx $uri.xls $uri.xlsx $uri.ppt $uri.pptx $uri.odf $uri.odp $uri.>
    }

    # additional config
#    include nginxconfig.io/general.conf;
}

Chaika•14mo ago

and wellard.org is the one that's broken, I assume?

WellardOP•14mo ago

specifically subdomains but yes e.g. www.wellard.org

Chaika•14mo ago

I don't think you're supposed to have commas in server_name, supposed to be space separated try removing the comma, validating the config and reloading, and then seeing if it works

WellardOP•14mo ago

it...worked thanks...but why? all my configs are comma separated

Chaika•14mo ago

I would assume because it's taking the , as a literal character to match on, and it works for the pleasehelpme one because it's the default

WellardOP•14mo ago

ok but that doesn't explain my other domain functioning www.pls-end.me also works

Chaika•14mo ago

right but that's your default

WellardOP•14mo ago

so I have 2 defaults? www.pls-end.me and i.helpmeplea.se both function with commas

Chaika•14mo ago

What's the ssl/tls setting for pls-end.me?

WellardOP•14mo ago

full (strict) as are the rest

Chaika•14mo ago

that is weird, is the config for pls-end.me the exact same? *.pls-end.me,?

WellardOP•14mo ago

yeah, I just cp'd them and changed the domain

Chaika•14mo ago

hmm, idk then, don't know enough about nginx to try to guess more. You could try the same openssl command on the subdomain of pls-end.me and see if it's serving the right one for sure

WellardOP•14mo ago

that explains why i was getting unknown error until I removed the default config at least though wait that's returning helpmeplea.se cert too and CF is just accepting Thonk

wait it's redirecting there's a www redirect somewhere in CF's panel isn't there?

Chaika•14mo ago

If it's a CF redirect it wouldn't even try the origin not by default but there's lots of ways you can make one with page rules, redirect rules, etc

WellardOP•14mo ago

nope, only page rule is cache and no redirect rule

Chaika•14mo ago

https://www.pls-end.me works for you?

WellardOP•14mo ago

redirects to https://pls-end.me

Chaika•14mo ago

It looks like what is happening is it gets a 526, and then serves an Always Online Archived version, which is just a redirect

Chaika•14mo ago

If you try curling it, I see a 526 curl https://www.pls-end.me/ -vvv, but in the browser, it looks like it loads the error page, and then the Always Online version

Chaika•14mo ago

If you turned off Always online under Caching -> Configuration, it should constantly serve 526s funny behavior though lol, I was confused at first why curl was 526ing but in the web browser it worked, getting saved by Always Online

WellardOP•14mo ago

I think that's about the only time it's functioned for me just to screw me over

Chaika•14mo ago

it's only for specific error codes, got lucky, or perhaps unlucky ;p

WellardOP•14mo ago

well I disabled it and purged cache there we go

Chaika•14mo ago

congrats on properly breaking it

Chaika•14mo ago

well, now you can fix it

WellardOP•14mo ago

:3 I'm pretty good at that, there's a whole site about the things i've bricked lmao

Chaika•14mo ago

well this was a relatively simple mistake and easy fix, just had to unravel it

WellardOP•14mo ago

yep, thanks for all your help both of you moniheart

Gaming

Programming

Invalid SSL cert on subdomains