SSL23_GET_SERVER_HELLO:unknown protocol, how do I fix my SSL cert?
Written by: J Dawg
I’m trying to
wget to my own box, and it can’t be an internal address in the wget (so says another developer).
Possibilities: This error happens when OpenSSL receives something other than a
ServerHello in a protocol version it understands from the server. It can happen if the server answers with a plain (unencrypted) HTTP. It can also happen if the server only supports e.g. TLS 1.2 and the client does not understand that protocol version.
When I wget, I get this:
wget http://mydomain.com --2013-03-01 15:03:30-- http://mydomain.com/ Resolving mydomain.com... 172.20.0.224 Connecting to mydomain.com|172.20.0.224|:80... connected. HTTP request sent, awaiting response... 302 Found Location: https://www.mydomain.com/ [following] --2013-03-01 15:03:30-- https://www.mydomain.com/ Resolving www.mydomain.com... 172.20.0.224 Connecting to www.mydomain.com|172.20.0.224|:443... connected. OpenSSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol Unable to establish SSL connection.
I believe it is because I do not have the certificate setup properly. Using openssl:
openssl s_client -connect mydomain.com:443 CONNECTED(00000003) 15586:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:588:
While if I do the same command on another site, it shows the entire cert.
Perhaps the ssl cert was never setup in the conf file on Apache for that domain?
If so, what should I be specifying in the virtualhost? Is there any alternative other than specifying
--no-certificate-check because I don’t want to do that?
This error happens when OpenSSL receives something other than a
ServerHello in a protocol version it understands from the server. It can happen if the server answers with a plain (unencrypted) HTTP. It can also happen if the server only supports e.g. TLS 1.2 and the client does not understand that protocol version. Normally, servers are backwards compatible to at least SSL 3.0 / TLS 1.0, but maybe this specific server isn’t (by implementation or configuration).
It is unclear whether you attempted to pass
--no-certificate-check or not. I would be rather surprised if that would work.
A simple test is to use
wget (or a browser) to request
http://mydomain.com:443 (note the
https://); if it works, SSL is not enabled on port 443. To further debug this, use
openssl s_client with the
-debug option, which right before the error message dumps the first few bytes of the server response which OpenSSL was unable to parse. This may help to identify the problem, especially if the server does not answer with a
ServerHello message. To see what exactly OpenSSL is expecting, check the source: look for
In any case, looking at the apache error log may provide some insight too.
There are a few possibilities:
Your workstation doesn’t have the root CA cert used to sign your server’s cert. How exactly you fix that depends on what OS you’re running and what release, etc.(I suspect this is not related)
- Your cert isn’t installed properly. If your SSL cert requires an intermediate cert to be presented and you didn’t set that up, you can get these warnings.
- Are you sure you’ve enabled SSL on port 443?
For starters, to eliminate (3), what happens if you telnet to that port?
Assuming it’s not (3), then depending on your needs you may be fine with ignoring these errors and just passing –no-certificate-check. You probably want to use a regular browser (which generally will bundle the root certs directly) and see if things are happy.
If you want to manually verify the cert, post more details from the
openssl s_client output. Or use
openssl x509 -text -in /path/to/cert to print it out to your terminal.