Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenSSL::SSL::SSLError: hostname "XYZ" does not match the server certificate #8

Open
ballertv opened this issue Jul 23, 2015 · 11 comments
Open

OpenSSL::SSL::SSLError: hostname "XYZ" does not match the server certificate #8

ballertv opened this issue Jul 23, 2015 · 11 comments

Comments

@ballertv
Copy link

Hi,

I'm having issues trying to use rack-reverse-proxy to host a wordpress blog from another site on my heroku domain. I'm using puma server and when I try to go to https://mydomain.com/blog I get the following error:

OpenSSL::SSL::SSLError: hostname "XYZ" does not match the server certificate

Everything seems to work fine if I don't use SSL. I have verified that the certificates on my wordpress blog and heroku site match (other than the wordpress blog has a different hostname I guess), but can't figure out how to resolve this. Any help is much appreciated.

Very helpful gem btw.

Thanks! Aaron
@alex-fedorov
Copy link

Do you proxy in this fashion:

  • HTTPS (domain A) => HTTPS (domain B), or
  • HTTPS (domain A) => HTTP ?

@ballertv
Copy link
Author

Hi Alex, thanks for the reply! I'm redirecting my /blog to a wordpress blog hosted on a subdomain at flywheelsites. The admins at flywheel installed my matching SSL certificate. When I run

openssl s_client -connect YXZ.com:443

and

openssl s_client -connect XYZ.flywheelsites.com:443

The certs seem to match.

Here's my code:

config.ru

use Rack::ReverseProxy do
  reverse_proxy /^\/blog(\/.*)$/, 'https://XYZ.flywheelsites.com$1', :preserve_host => true
end

In my routes, I also have:

get "/blog" => redirect("https://www.XYZ.com/blog/")

@waterlink
Copy link
Owner

can you try to make a request with curl in verbose mode and paste the output in gist? curl -vvv https://www.XYZ.com/blog

@ballertv
Copy link
Author

This is the response for /blog:

* Hostname was NOT found in DNS cache
*   Trying 50.16.185.191...
* Connected to www.getballer.com (50.16.185.191) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* Server certificate: *.getballer.com
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> GET /blog HTTP/1.1
> User-Agent: curl/7.37.1
> Host: www.getballer.com
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
* Server Cowboy is not blacklisted
< Server: Cowboy
< Connection: keep-alive
< Strict-Transport-Security: max-age=31536000
< Location: https://www.getballer.com/blog/
< Content-Type: text/html
< Vary: Accept-Encoding
< X-Ua-Compatible: IE=Edge,chrome=1
< Cache-Control: no-cache
< X-Request-Id: b1d9be05-3e45-455e-b85c-72643c985af9
< X-Runtime: 0.003897
< Date: Fri, 24 Jul 2015 23:26:07 GMT
< X-Rack-Cache: miss
< Content-Length: 97
< Via: 1.1 vegur
< 
* Connection #0 to host www.getballer.com left intact
<html><body>You are being <a href="https://www.getballer.com/blog/">redirected</a>.</body></html>

And here is the output for /blog/

curl -vvv https://www.getballer.com/blog/
* Hostname was NOT found in DNS cache
*   Trying 107.20.210.14...
* Connected to www.getballer.com (107.20.210.14) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* Server certificate: *.getballer.com
* Server certificate: COMODO RSA Domain Validation Secure Server CA
* Server certificate: COMODO RSA Certification Authority
* Server certificate: AddTrust External CA Root
> GET /blog/ HTTP/1.1
> User-Agent: curl/7.37.1
> Host: www.getballer.com
> Accept: */*
> 
< HTTP/1.1 500 Internal Server Error
* Server Cowboy is not blacklisted
< Server: Cowboy
< Date: Fri, 24 Jul 2015 23:26:42 GMT
< Connection: keep-alive
< Content-Length: 76
< Via: 1.1 vegur
< 
An unhandled lowlevel error occured. The application logs may have details.
* Connection #0 to host www.getballer.com left intact

@waterlink
Copy link
Owner

Ok. That means that this error occurs when your proxy app (heroku) tries to connect to your blog app, which sits on HTTPS. I assume that some header (like ORIGIN or something else, that contains host of your proxy app) gets passed in request that makes ssl library to reject certificates.

Have you tried to set :preserve_host => false ? What happens in this case?

@ballertv
Copy link
Author

I just push the code with :preserve_host => false and same problem. I've reached out to the blog hosting company to see if it is something on their end. Any other way to debug and see what is going on under the hood?

Really appreciate your help, thanks!

@waterlink
Copy link
Owner

It can be a problem with reverse proxying concept. I always got ssl errors with https => https proxying, even on standard reverse proxies, like NGINX. With nginx what you usually do is https => http server directly. So there is a chance, that this error is expected..

@justinkuepper
Copy link

FYI, I came across this same problem and thought I'd make the solution a bit clearer.

In this code above:

use Rack::ReverseProxy do reverse_proxy /^\/blog(\/.*)$/, 'https://XYZ.flywheelsites.com$1', :preserve_host => true end

You need to make sure the Flywheel website is http:// instead of https://, like this:

use Rack::ReverseProxy do reverse_proxy /^\/blog(\/.*)$/, 'http://XYZ.flywheelsites.com$1', :preserve_host => true end

Then, it should work as expected.

@MrMarvin
Copy link
Contributor

Just to link this here, with PR #24, it is possible to disable https certificate validation altogether.

@waterlink
Copy link
Owner

@MrMarvin I have released 0.10.0 with your change.

@fabes
Copy link

fabes commented Feb 27, 2019

Thank you @justinkuepper! Your solution works for me!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@MrMarvin @waterlink @fabes @justinkuepper @alex-fedorov