Nginx proxy to node.js server SSL ERR_SSL_PROTOCOL_ERROR

Question

EDIT:

I have verified that nodejs is running on the correct port, on http, and I have also tried with and without:

app.use('trust proxy', true);

EDIT 2:

I turned off the nodejs server and tried to serve static files just with nginx, and the error persists, so clearly this has something to do with nginx and my ssl cert.

My domain is a free domain from freenom and the ssl certificate was generated with certbot.

Original:

I have a nodejs server running, and want to use nginx and proxy to the nodejs server. (Nginx https -> nodejs http)

Running nginx -t gives no errors.

On ubuntu 20.04.2 , nginx 1.18.0 node 14.5.5

I have verified that my site works fine via http (on port 3000), but i get the following error when visiting via browser on https:

ERR_SSL_PROTOCOL_ERROR

Further if i use openssl cli to try and connect, I get this

openssl s_client -connect my_domain.com:443 -servername my_domain.com

CONNECTED(00000003)
139662603941184:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:331:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 310 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

/etc/nginx/conf.d/ssl.conf

server {
    listen 443 ssl;

    ssl_certificate     /server/resources/cert.pem;
    ssl_certificate_key /server/resources/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}
}

Answer 1

If you use Cloudflare, It may Cloudflare not issued SSL certificate for you yet, or Cloudflare failed to connect to origin with secure connection. Check your dashboard.

Answer 2

Following is the working configuration of nginx.conf

I have also setup SSL with certbot + letsencrypt.

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}


server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name example.com www.example.com;
    root "/home/ubuntu/domain/code/directory/path/";
    index index.html index.htm;
    client_max_body_size 75M;   # adjust to taste

    location /api {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 600s;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_session_timeout 1h;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    add_header Strict-Transport-Security “max-age=15768000” always;
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
}

I guess the above configuration might solve your issue.

URL is https://www.example.com/api/ping redirects to http://localhost:3000/api/ping on the server.