ERR_SSL_PROTOCOL_ERROR only for some users (nodejs, express)

Question

Only some (not all) users are receiving ERR_SSL_PROTOCOL_ERROR in Chrome when attempting to visit my express site. I am not receiving this error, so it is proving a pain to debug.

I am creating a https server using a PFX file I downloaded from my provider (1&1):

var options = {
  pfx: fs.readFileSync('./mysite_private_key.pfx'),
  passphrase: 'MYPASSPHRASE',
};
https.createServer(options, app).listen(443); 

https://whatsmychaincert.com tells me that the chain is correct but complains about the handshake:

[mysite] has the correct chain.

[mysite]: TLS handshake error: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error SSL Labs might be able to tell you what went wrong

I've googled this with no success, does anyone know what the problem could be? Ty.

Answer 1

In the end I ditched 1&1 and used GoDaddy's CA service and the problem went away.

Answer 2

A possible source of failed handshake could be the lack of an intermediate certificate, ca option of tls.createSecureContext . It should by public on your provider's website.

Hope this helps.

Answer 3

nowadays, when our server (eg 1&1) is securely configured, only tls v1.2 and tls v1.3 are supported..

so how you debug this:

• scan your site with SSL Labs Test too see which ciphers are supported, or alternately see in our nginx/apache config

• tail -f the server logs, especially the catchall/other_vhosts log files,since ssl protocol errors might be in the site logs and the generic catchall log when the server cannot decide on the name

• try to update the users chrome to support at least tls 1.2

  chrome has the some command line switches to change its cipher behaviour:

• • --ssl-version-max Specifies the maximum SSL/TLS version ("tls1.2" or "tls1.3"). ↪
• • --ssl-version-min Specifies the minimum SSL/TLS version ("tls1", "tls1.1", "tls1.2", or "tls1.3"). ↪

DANGER ZONE:

• as last resort you could try to accept legacy ciphers in your nginx-config ( ssl_ciphers directive) like socat OR (very last resort) socat23 to check which version your clients support,

remember to disable everything below tls v1.2 in production environment