SSL error (ERR_SSL_PROTOCOL_ERROR) with port number

[dibakar]

Hello,

I am trying to set up SSL certificate for my url. It is working as expected wothout the port numbers but I am getting SSL related error if I specify port. I tried with permitted ports 2052 (HTTP) and 2053 (HTTPS). I am getting errors ERR_SSL_PROTOCOL_ERROR (FOR http PORT), Invalid SSL certificate (for https port). See screenshot below, I can include only one.

*Was the site working with SSL prior to adding it to Cloudflare? No

*Have you tried from another browser and/or incognito mode? Yes, same error

Please attach a screenshot of the error:

HTTP port 2052 error:

Thanks,
Diba

[dibakar]

The error on HTTPS port

[Laudian]

It seems like you do not have a valid certificate configured for the webserver that is listening on port 2053.

@dibakar

*Was the site working with SSL prior to adding it to Cloudflare? No

That is likely the problem.

[dibakar]

@Laudian

It seems like you do not have a valid certificate configured for the webserver that is listening on port 2053.

Are you suggesting I might be running two webservers on same IP? That could explain HTTPS port 2053 error but why will I have problem with HTTP port 2052. I am using flexible encryption.

[epic.network]

@dibakar

flexible encryption

That insecure setting is often the cause of many problems. It should never be used.

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

[dibakar]

@epic.network

That insecure setting is often the cause of many problems. It should never be used.

I struggled with full and strict encryption as well. I am trying to make it work with flexible first and then move to strict.

[Laudian]

That approach is unlikely to work, as Flexible does not use SSL, while Full (Strict) requires a valid certificate. Both have completely different requirements.

@dibakar

Are you suggesting I might be running two webservers on same IP?

It really doesn’t matter whether you have different webservers or different configurations. Each needs to have the correct certificate configured.

The simplest way is to pause Cloudflare, make sure your site loads fine with SSL, and then reactivate Cloudflare.

[dibakar]

@Laudian

That approach is unlikely to work, as Flexible does not use SSL, while Full (Strict) requires a valid certificate. Both have completely different requirements.

My requirement is just to make https url to work. And it is working as long as I do not specify the port number.

[Laudian]

Do you even have a webserver listening on port 2052/2053? What do you expect to see on that port?

And still, to make https work, you should change SSL to Full (strict). Flexible does not offer any encryption.

[dibakar]

@Laudian

Do you even have a webserver listening on port 2052/2053? What do you expect to see on that port?

Port 2052 and 2053 are forwarded to internal port 2342. I have openmediavault running on default port and photoprism on 2342, as a plugin. Both are accessible internally and through other non SSL url. But when I am using cloudflare certified URL, I am only able to run the default port.

@Laudian

And still, to make https work, you should change SSL to Full (strict). Flexible does not offer any encryption.

My understanding is that flexible encryption will let you have https url without the SSL, and my default https url is working fine without SSL. Maybe it is a bad idea but my question is why the url won’t work when I provide a port number, what extra steps I need to take to make it work.

[dibakar]

Continuing the discussion from SSL error (ERR_SSL_PROTOCOL_ERROR) with port number:

Solved: Read in another forum flexible option only works with default port.Thanks for looking into the issue.

[sandro]

As mentioned by @epic.network and @Laudian you shouldnt use that insecure legacy mode in the first place as it will (evidently) break your site and drop all security.

Bottom line, your site needs to work fine on SSL before you use Cloudflare.