Common problems and solutions for HTTPS deployment

This article and we share the main is the HTTPS common deployment problems and the corresponding solution, hope that through the sharing of this article can help you learn More about HTTPS knowledge, come together to see it.

in fact, encountering any relevant deployment HTTPS or http/2 , it is recommended to run a test with Qualys SSL Labs ' s SSL Server test , most of which can be diagnosed.

You have been unable to verify the Encrypt certificate by

This kind of problem is usually because Let's Encrypt not be able to access your server, it is recommended to try the acme.sh DNS authentication Mode , generally can be resolved.

website inaccessible, prompt err_certificate_transparency_required

Use This error message is likely to occur when you visit a website that uses Symantec certificates. This issue is caused by a Bug in Chrome , and the best solution now is to upgrade to Chrome 54+.

browser prompts certificate with error

first make sure the site is using a legitimate a valid certificate issued by the CA, followed by checking the integrity of the certificate in the Web Server configuration (be sure to include the site certificate and all intermediate certificates). If the intermediate certificate is missing, some browsers can obtain it automatically but severely affect the TLS handshake performance; some browsers report a certificate error directly.

 ie8 on Windows xp HTTPS  site, so that   is not supported; sni ( server Name indication Browsers that

 sni  site deployed on different servers ; You can also take advantage of the san ( subject Alternative name ) The mechanism puts multiple domain names in the same certificate, and of course you can ignore these old browsers directly. In particular, the use does not support   Browser access to commercial  ,

about For more information about SNI, see " Some experience sharing about enabling HTTPS (ii) ".

Web site cannot be accessed after enabling HTTP/2, prompting err_spdy_inadequate_transport_security

 ciphersuite  the wrong configuration. Recommended comparison of "  recommended configuration ,   configuration  "and other authoritative configuration modifications  nginx  configuration items.

for specific reasons for this problem, see "  from enabling the HTTP/2 to cause the website to be inaccessible. ".

website inaccessible, prompt Err_ssl_version_or_cipher_mismatch

This error usually occurs when you configure an unsafe SSL version or ciphersuite-- For example the server only supports SSLv3, or ciphersuite only configures the /c7>RC4 series, You'll get this tip with Chrome access. The solution is the same as in the previous section.

there is another situation where this error can occur——use does not supportECCbrowser access is available onlyECCCertificate of the Web site. For example, inWindows XP, useECCThe certificate site is onlyFirefoxcan access (Firefoxof theTLSown implementation, do not rely on the operating system);Androidplatform, you also need toAndroid 4+only supportECCcertificate. If this is the case, there is a perfect solution, see "Getting Started withECCcertificate ".

the browser still uses http/1.1 after the Nginx http/2 is enabled

Chrome 51+removed from theNPNSupport , only supportALPN, while both the browser and the server supportNPNorALPN, is used onHTTP/2's premise. In other words, if the service side does not supportALPN,Chrome 51+cannot be usedHTTP/2.

OpenSSL 1.0.2 only started to support alpn-- Many of the major server systems come with OpenSSL below this version, so it is recommended to compile Web Server specifies The location of OpenSSL itself.

See "  Why should we support ALPN as soon as possible ? ".

site Partial resource does not load or is not safe after upgrading to HTTPS

remember a principle: all external links to HTTPS websites (CSS,JS, pictures, audio, font files, async interfaces, form action Address, and so on) need to be upgraded to HTTPS, you will not encounter this problem.

Source: Jerryqu 's station

Frequently asked questions and solutions for HTTPS deployment