nginx listen ... ssl directive error, but there is no ssl directive set

Question

I don't understand where nginx is getting the listen ... ssl directive from. It prevents nginx from starting...

/docker-entrypoint.sh: Configuration complete; ready for start up

2020/11/16 10:25:45 [emerg] 1#1: no "ssl_certificate" is defined for the "listen ... ssl" directive in etc/nginx/conf.d/default.conf:28

nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/conf.d/default.conf:28

my conf.d/default.conf:

# redirect all traffic to https
#server {
#    listen 80 default_server;
#    listen [::]:80 default_server;
#    server_name _;
#    return 301 https://$host$request_uri;
#}

server {
    listen           80 default_server;
    listen      [::]:80 default_server;
    server_name _;

    # Write Access and Error logs
    access_log        /var/log/nginx/.access.log;
    error_log         /var/log/nginx/error.log;

    # CertBot needs either port 80 or 443 open to connect to the
    location ^~ /.well-known/acme-challenge/ {
        root           /var/www/letsencrypt;
    }

#    location / {
#        return 301 https://$host$request_uri;
#    }
}

server {
    listen       443;
    listen  [::]:443;
    server_name  _;

    #charset koi8-r;
    #access_log  /var/log/nginx/host.access.log  main;

    # Certificates
#    ssl_certificate         /etc/letsencrypt/live/.../fullchain.pem;
#    ssl_certificate_key     /etc/letsencrypt/live/.../fullchain.pem;
    # verify chain of trust of OCSP response using Root CA and Intermediate certs
#    ssl_trusted_certificate /etc/letsencrypt/live/.../fullchain.pem;

#    include ssl.conf;

    set $upstream_webfuse_com JS_upstream;

    location / {
        # allow CORS
        #add_header 'Access-Control-Allow-Origin' '*' always;

        include proxy.conf;
        resolver 127.0.0.11 valid=30s;
        proxy_pass http://$upstream_webfuse_com:3000;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;

        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/htpasswd;
    }

    #location / {
    #    root   /usr/share/nginx/html;
    #    index  index.html index.htm;
    #}

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    # proxy the PHP scripts to Apache listening on 127.0.0.1:80
    #
    #location ~ \.php$ {
    #    proxy_pass   http://127.0.0.1;
    #}

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

    #location ~ \.php$ {
    #    root           /usr/share/nginx/html;
    #    fastcgi_pass   127.0.0.1:9000;
    #    fastcgi_index  index.php;
    #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
    #    include        fastcgi_params;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one

    #location ~ /\.ht {
    #    deny  all;
    #}
}

server {
    listen      443;
# ssl http2;
    listen [::]:443;
# ssl http2;

    server_name coder.*;

    # Certificates
    #ssl_certificate         /etc/letsencrypt/live/.../fullchain.pem;
    #ssl_certificate_key     /etc/letsencrypt/live/.../fullchain.pem;
    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    #ssl_trusted_certificate /etc/letsencrypt/live/.../fullchain.pem;

    #include ssl.conf;

    client_max_body_size 0;

    # CertBot needs either port 80 or 443 open to connect to the
    location ^~ /.well-known/acme-challenge/ {
        root           /var/www/letsencrypt;
    }

    location / {
        include proxy.conf;
        resolver 127.0.0.11 valid=30s;
        set $upstream_code_server coder;
        proxy_pass http://$upstream_code_server:8443;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
    }
}

Timo Tijhof · Accepted Answer · 2023-07-09 23:16:02Z

5

You listen on port 443. That's the SSL port.

server {
listen       443;
listen  [::]:443;

You need to remove the listen on port 443, or add a certificate. Otherwise, it will not work.

edited Jul 9, 2023 at 23:16

Timo Tijhof

10.4k6 gold badges38 silver badges53 bronze badges

answered Nov 16, 2020 at 10:49

NRE

6846 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

controlol Over a year ago

hmm okay, I believe I had it working without before, while I was generating the ssl certs with certbot...

c.gooderham94 Over a year ago

@controlol I also have the same issue - I've always commented out SSL settings in the 443 server block whilst provisioning the SSL certificate with certbot, then uncomment. However, now I don't seem to be able to, what's changed...

Dorado Over a year ago

This solved my issue to listen on 443 without the need to define a SSL directive.

logi · Accepted Answer · 2023-02-24 11:12:40Z

1

Actually, there is a different answer to that and I believe that is the correct one.

Using a listen 443 ssl or ssl on in any other vhost within same nginx instance - makes precedence and forces every other vhost that listening on 443 to define ssl_certificate. It's obviously a bug in my opinion and I wasted like 4 hours to debug that weird behavior.

I just discovered this today's morning and it seems not to be documented n the official documentation.

Debian 11 Bullseye and nginx 1.18.0 from official repo.

edited Feb 24, 2023 at 11:12

answered Feb 24, 2023 at 11:09

logi

112 bronze badges

2 Comments

controlol Over a year ago

Your nginx version is nearly three years old at this point. The issue you are describing could already be fixed. The current stable version is 1.22.1

logi Over a year ago

I've received an answer from a developer (I suppose), this is how sockets works. trac.nginx.org/nginx/ticket/2460

Zeeshan Ali · Accepted Answer · 2024-04-28 08:15:42Z

0

In my case i configured my serverblock like this after the error i faced mentined above

server {   
    listen   443 ssl;
    #ssl    on;
}

answered Apr 28, 2024 at 8:15

Zeeshan Ali

1361 silver badge4 bronze badges

Collectives™ on Stack Overflow

nginx listen ... ssl directive error, but there is no ssl directive set

3 Answers 3

3 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related