Opened 8 years ago

Closed 8 years ago

#1107 closed defect (duplicate)

Nginx config test dose not fail when config is invalid resulting in a running but none functional server

Reported by: DrHofman@… Owned by:
Priority: major Milestone:
Component: other Version: 1.8.x
Keywords: config ssl Cc:
uname -a: Linux production-3 3.10.0-327.10.1.el7.x86_64 #1 SMP Tue Feb 16 17:03:50 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.8.1
built by gcc 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC)
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_spdy_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic'

Description

This is an example of the config, my expectation is that this config will fail the validation (nginx -t), however this config passes validation and the server starts successfully.

user  nginx;
worker_processes 1;

events {
    worker_connections 1024;
}

http {

    server {
        listen 443 ssl default_server;

        return 200 'gangnam style!';
        add_header Content-Type text/plain;
    }

    server {
        listen 443 ssl;
        server_name some.domain.com;

        ssl_certificate /etc/nginx/certs/fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/privkey.pem;

        return 200 'gangnam style!';
        add_header Content-Type text/plain;
    }

}

http traffic works fine but all ssl connection to any vhost fail with

curl: (35) Server aborted the SSL handshake

This issue is not easy to debug and can be very frustrating and time consuming

Change History (1)

comment:1 by Maxim Dounin, 8 years ago

Resolution: → duplicate
Status: new → closed

Duplicate of #178.

Note: See TracTickets for help on using tickets.