Nginx failed to start after updating SSL files

eavenhuang · February 2, 2023, 7:43am

Dear Experts,

I’m trying to update SSL cert but nginx failed to start due to dhparam.pem error.
It seems that this file is encrypted that I can’t check it directly.

What can we do with it?
Thanks a lot!

Feb 02 14:43:15 zammad nginx[2754]: nginx: [emerg] unexpected end of file, expecting “;” or “}” in /etc/nginx/sites-enabled/dhparam.pem:14
Feb 02 14:43:15 zammad nginx[2754]: nginx: configuration file /etc/nginx/nginx.conf test failed
Feb 02 14:43:15 zammad systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE

eavenhuang · February 2, 2023, 9:28am

Dear All,

I’m not sure if it’s something to do with my new cert but if I commented out ssl-dhparam in zammad.conf, it works fine:(

MrGeneration · February 14, 2023, 9:50pm

The dhparam parameter basically is being used incorrect. Most likely you had forgotten to add an ; at the end. You can find an correct example in our example conf file:

github.com

zammad/zammad/blob/develop/contrib/nginx/zammad_ssl.conf#L57


      
          server_tokens off;
          
          ssl_certificate /etc/nginx/ssl/example.com-fullchain.pem;
          ssl_certificate_key /etc/nginx/ssl/example.com-privkey.pem;
          
          ssl_protocols TLSv1.2;
          
          ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
          
          ssl_dhparam /etc/nginx/ssl/dhparam.pem;
          
          ssl_prefer_server_ciphers on;
          
          ssl_session_cache shared:SSL:10m;
          ssl_session_timeout 180m;
          
          ssl_stapling on;
          ssl_stapling_verify on;
          
          ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;

eavenhuang · February 21, 2023, 4:10pm

Dear expert,

if you are talking about the ;; in zammad.config file in /etc/nginx/sites-enabled, we have the ; there. anyway, we have to comment out ssl_dhparam line then we have no issues with zammad running.

system · June 21, 2023, 4:10pm

This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.