Fixing Apache ‘ssl_error_rx_record_too_long’ on Alpine Linux (SSL Port 443 Mismatch)

Resolve the 'ssl_error_rx_record_too_long' error on Alpine Linux Apache servers, ensuring correct SSL configuration for HTTPS on port 443.

Introduction

Encountering "ssl_error_rx_record_too_long" in your browser when trying to access an Apache web server configured for HTTPS can be a frustrating experience. This error typically indicates that your browser, expecting a secure SSL/TLS handshake on port 443, instead received plain unencrypted HTTP data, or malformed SSL data, leading to a protocol mismatch. On Alpine Linux, with its lean and secure defaults, this issue often stems from subtle misconfigurations in Apache's SSL setup, preventing the mod_ssl module from properly encrypting traffic on the designated HTTPS port.

This guide will walk you through diagnosing and resolving this common issue on an Alpine Linux Apache server, ensuring your site serves content securely over HTTPS.

Symptom & Error Signature

When experiencing this issue, users will typically see an error page in their web browser, often accompanied by a specific error code.

Browser Error Examples:

• Firefox: "SSL_ERROR_RX_RECORD_TOO_LONG"
• Chrome/Edge: "ERR_SSL_PROTOCOL_ERROR" or "This site can't provide a secure connection"

Apache Access/Error Log Entries (less common for this specific error, but worth checking):

While ssl_error_rx_record_too_long is primarily a client-side (browser) error indicating a problem with the server's initial response, Apache's error_log might show related issues if mod_ssl fails to initialize or encounters certificate problems.

[timestamp] [error] [pid XXXXX:tid XXXXX] (X)Permission denied: [client IP:port] AH00088: Unable to access the SSL_CTX_set_session_id_context shared memory semaphore
[timestamp] [error] [pid XXXXX:tid XXXXX] SSL Library Error: error:140A80B1:SSL routines:SSL_CTX_new:system lib

The above log entries are less frequent but can point to underlying issues with SSL initialization or file permissions, which indirectly lead to the browser error. The primary indicator for this specific problem is the browser error itself.

Root Cause Analysis

The core reason behind the ssl_error_rx_record_too_long error on port 443 is that the web server (Apache) is sending non-SSL (plain HTTP) data when the client (browser) expects SSL/TLS encrypted data. For Alpine Linux Apache specifically, this usually boils down to one or more of the following:

1. mod_ssl Not Enabled or Loaded: Apache's SSL capabilities are provided by the mod_ssl module. If this module is not enabled or fails to load correctly, Apache will not be able to perform SSL handshakes, and any traffic directed to port 443 will be treated as plain HTTP.
2. Incorrect VirtualHost Configuration:
   • A VirtualHost block configured for plain HTTP (e.g., missing SSLEngine On) is accidentally listening on port 443.
   • The VirtualHost *:443 block is present but lacks SSLEngine On or has incorrect SSLCertificateFile/SSLCertificateKeyFile directives.
   • An HTTP VirtualHost (port 80) is inadvertently configured with Listen 443, overriding the SSL configuration.
3. Conflicting Listen Directives: Multiple Listen directives for port 443, or a Listen 443 directive placed within a non-SSL VirtualHost block, can cause ambiguity or incorrect protocol binding.
4. Incorrect Certificate/Key Paths or Permissions: If Apache cannot read the specified SSL certificate (.crt) or private key (.key) files due to incorrect paths or file permissions, mod_ssl will fail to initialize, resulting in plaintext responses.
5. Another Service on Port 443: Less common but possible: another application is already bound to port 443, preventing Apache from listening correctly. This usually manifests as Apache failing to start, but could lead to unexpected behavior if it's a proxy that misbehaves.

Step-by-Step Resolution

Follow these steps to diagnose and resolve the "ssl_error_rx_record_too_long" issue on your Alpine Linux Apache server.

1. Verify Apache Status and mod_ssl Module

First, ensure Apache is running and that the mod_ssl module is loaded.

1. Check Apache Service Status:

   sudo rc-service apache2 status
   

   You should see output indicating apache2 is started. If not, try to start it and check logs for errors:

   sudo rc-service apache2 start
   sudo tail -f /var/log/apache2/error_log
   

2. Confirm mod_ssl is Enabled and Loaded: On Alpine, Apache modules are typically enabled by ensuring their configuration file exists in conf.d and is included. mod_ssl is usually enabled via /etc/apache2/conf.d/ssl.conf or a similar include.

   First, check if mod_ssl is compiled and available:

   apache2 -M | grep ssl_module
   

   If you don't see ssl_module (shared), you might need to install it. Alpine's apache2 package usually includes mod_ssl, but ensure you have the apache2-ssl package if it's separated in your version.

   sudo apk add apache2-ssl # if not already installed
   

   Next, ensure the module is explicitly loaded in your httpd.conf. Look for lines similar to this:

   # In /etc/apache2/httpd.conf or a file in /etc/apache2/conf.d/
   LoadModule ssl_module modules/mod_ssl.so
   

   Also, confirm that the SSL configuration file is included. This is typically where mod_ssl directives reside.

   # In /etc/apache2/httpd.conf
   Include conf.d/ssl.conf
   

   Make sure /etc/apache2/conf.d/ssl.conf exists and contains basic SSL directives.

2. Inspect Apache Configuration Files for Port 443

The most common cause is an incorrect configuration around the Listen 443 directive and the corresponding VirtualHost block.

1. Locate Configuration Files: Main Apache config: /etc/apache2/httpd.conf SSL-specific config: /etc/apache2/conf.d/ssl.conf (or a similar name) VirtualHost configs: /etc/apache2/conf.d/vhosts.conf or individual files in /etc/apache2/conf.d/vhosts/

2. Verify Listen 443: Ensure Apache is listening on port 443. Check httpd.conf and any included files. There should be only one Listen 443 directive.

   # In /etc/apache2/httpd.conf or conf.d/ssl.conf
   Listen 443 https
   

   Avoid having Listen 443 inside a <VirtualHost> block unless you explicitly know why and how to correctly configure it. Typically, Listen directives are global.

3. Review VirtualHost *:443 Configuration: This is critical. Find your HTTPS VirtualHost block for port 443.

   # In /etc/apache2/conf.d/ssl.conf or a dedicated vhost file
   <VirtualHost *:443>
       ServerName your-domain.com
       DocumentRoot /var/www/your-domain
   
       SSLEngine On
       SSLCertificateFile "/etc/ssl/your-domain/your-domain.crt"
       SSLCertificateKeyFile "/etc/ssl/your-domain/your-domain.key"
       SSLCACertificateFile "/etc/ssl/your-domain/chain.pem" # Optional, but recommended for full chain
       # Other SSL options (protocols, ciphers, headers)
       SSLProtocol All -SSLv2 -SSLv3
       SSLCipherSuite HIGH:!aNULL:!MD5
       Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
       Header always set X-Content-Type-Options "nosniff"
       Header always set X-XSS-Protection "1; mode=block"
       Header always set X-Frame-Options "DENY"
   
       # ... other directives for your site (Log files, Directory, etc.)
   </VirtualHost>
   

   • SSLEngine On: This directive MUST be present within the VirtualHost *:443 block. If it's missing or SSLEngine Off, Apache will serve plain HTTP on port 443.
   • SSLCertificateFile & SSLCertificateKeyFile: Verify the paths are absolutely correct and point to your actual certificate and private key files.
   • SSLCACertificateFile: While optional, it's good practice to include your certificate authority (CA) bundle for better browser compatibility.

3. Check Certificate and Key File Permissions

Incorrect permissions on your SSL certificate and key files can prevent Apache from reading them, leading to SSL initialization failure.

1. Verify File Paths and Ownership: Navigate to the directories where your certificate and key files are stored (e.g., /etc/ssl/your-domain/).

   ls -l /etc/ssl/your-domain/
   

2. Adjust Permissions:

   • The private key file (.key) should be readable only by the root user or the user Apache runs as, and no one else.

     sudo chmod 600 /etc/ssl/your-domain/your-domain.key
     sudo chown root:root /etc/ssl/your-domain/your-domain.key
     

   • The certificate file (.crt) and chain file (.pem) can be world-readable, but it's often safer to restrict them to root as well.

     sudo chmod 644 /etc/ssl/your-domain/your-domain.crt
     sudo chmod 644 /etc/ssl/your-domain/chain.pem
     sudo chown root:root /etc/ssl/your-domain/your-domain.crt
     sudo chown root:root /etc/ssl/your-domain/chain.pem
     

4. Test Apache Configuration Syntax

Before restarting Apache, always test your configuration for syntax errors.

sudo apache2ctl configtest

You should see Syntax OK. If there are errors, Apache will point to the problematic line and file. Correct any errors before proceeding.

5. Restart Apache Service

After making changes, restart Apache for them to take effect.

sudo rc-service apache2 restart

6. Verify Port Listening and Connectivity

1. Check if Port 443 is Open: Use netstat or ss to confirm Apache is listening on port 443.

   sudo netstat -tulnp | grep 443
   # Or for ss
   sudo ss -tulnp | grep 443
   

   You should see an entry like tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN PID/apache2

2. Test SSL Connection with openssl: You can simulate an SSL handshake from the server itself.

   openssl s_client -connect localhost:443
   

   If successful, you'll see a lot of SSL/TLS certificate information, the handshake details, and eventually Verify return code: 0 (ok). If you see errors like error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol, it still indicates a protocol mismatch, suggesting a deeper configuration issue.

3. Check Firewall Rules (if applicable): If netstat shows Apache listening on 443, but you still can't connect from an external machine, check your firewall (e.g., ufw, iptables).

   For iptables on Alpine (often manual or via iptables-persistent):

   sudo iptables -L -n
   

   Ensure there's a rule allowing incoming TCP traffic on port 443. If not, add one:

   sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
   # Remember to save iptables rules if they are not persistent by default
   

After completing these steps, try accessing your website again via HTTPS in your web browser. The ssl_error_rx_record_too_long error should now be resolved, and your site should load securely.