listen 443 ssl breaks nginx

Question

I've installed nginx on a GCE vm to host a personal website. I set it up and it works great for http connections. However, enabling https after installing certificated from certbot has broken nginx.

server {
    listen 80;
    listen [::]:80;

    # SSL configuration
    #
    #listen 443 ssl;
    # listen [::]:443 ssl default_server;
    # Note: You should disable gzip for SSL traffic.
    # See: https://bugs.debian.org/773332
    #
    # Read up on ssl_ciphers to ensure a secure configuration.
    # See: https://bugs.debian.org/765782
    #
    # Self signed certs generated by the ssl-cert package
    # Don't use them in a production server!
    #
    # include snippets/snakeoil.conf;

    root /home/Urvish/www;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    server_name openrados.ddns.net;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
    }


    # pass PHP scripts to FastCGI server
    #
    #location ~ \.php$ {
    #   include snippets/fastcgi-php.conf;
    #
    #   # With php-fpm (or other unix sockets):
    #   fastcgi_pass unix:/run/php/php7.3-fpm.sock;
    #   # With php-cgi (or other tcp sockets):
    #   fastcgi_pass 127.0.0.1:9000;
    #}

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    #location ~ /\.ht {
    #   deny all;
    #}

        listen [::]:443 ssl; # managed by Certbot
        listen 443 ssl; # managed by Certbot
        ssl_certificate /etc/letsencrypt/live/openrados.ddns.net/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/openrados.ddns.net/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

Now, restarting nginx using sudo systemctl restart nginx doesn't work anymore and gives the following error:

Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xe" for details.

systemctl status nginx.service returns the following:

● nginx.service - A high performance web server and a reverse proxy server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Wed 2020-02-05 12:48:27 UTC; 1min 11s ago
     Docs: man:nginx(8)
  Process: 6208 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
  Process: 6209 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=1/FAILURE)

How do I fix this? I'm confused.

Edit:

I ran nginx -t and it returns the following:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

However, the error logs under /var/log/nginx/error.log show the following:

2020/02/05 13:03:29 [emerg] 6392#6392: bind() to [::]:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to 0.0.0.0:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to [::]:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to 0.0.0.0:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to [::]:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to 0.0.0.0:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to [::]:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to 0.0.0.0:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to [::]:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: bind() to 0.0.0.0:443 failed (98: Address already in use)
2020/02/05 13:03:29 [emerg] 6392#6392: still could not bind()

The error says something else is already listening on port 443. Use `lsof -i` to see what it is. — hardillb, Feb 05 '20 at 13:56

score 0 · Accepted Answer · answered Feb 05 '20 at 13:39

0

None of those commands you have used actually describe the reason why nginx cannot restart.

A good place to start trying to figure out nginx problems when the service has failed is by running journalctl -u nginx or nginx -t. This will give you better clues as to why it has failed and in your case most likely point towards configuration file errors and the lines on which they reside.

It is also best practice to keep your configuration file as tidy as possible with the correct indentation along with removing unnecessary comments to make managing it slightly easier.

answered Feb 05 '20 at 13:39

twoddle

16

Ah, sorry! I've updated the question with the error logs and nginx-t. journalctl -u nginx doesn't return anything. – Urvish Ramaiy Feb 05 '20 at 13:53
There is another process binding to the same port and interface. Use 'netstat -lp | grep ":443"' to display the pid+process name. – twoddle Feb 05 '20 at 14:22

listen 443 ssl breaks nginx

1 Answers1