If you're anything like us, you use Laravel Forge to provision your servers and LetsEncrypt SSL certificates. After all, it's the defau...
If you're anything like us, you use Laravel Forge to provision your servers and LetsEncrypt SSL certificates. After all, it's the default way to do it, and it works out-of-the-box. The setup has worked great for us, for years.
But today, out of the blue, a bunch of our properties have gone down, showing either
Error 525 - SSL Handshake Failed (if ran through CloudFlare) or straight up
This site can't provide a secure connection, more specifically
In hindsight, it should have been an easy fix, but we scratched our head quite a bit to fix this. We hope posting this here will save you some pain.
Our problem, turns out, was that our NGINX configurations for those properties were a bit outdated, didn't support some TLS versions and more importantly, didn't support many ciphers.
To verify and fix this, on a site's page in Laravel Forge, go to the very bottom, and under "Files" you'll find the NGINX configuration file, and be able to edit it.
For us, it was as simple as adding more CloudFlare-supported ciphers to the list, but you might also want to enable other TLS versions.
listen 443 ssl http2; listen [::]:443 ssl http2; server_name app.somedomain.com; root /home/forge/app.somedomain.com/public; # FORGE SSL (DO NOT REMOVE!) ssl_certificate /etc/nginx/ssl/app.somedomain.com/1111111/server.crt; ssl_certificate_key /etc/nginx/ssl/app.somedomain.com/1111111/server.key; - ssl_protocols TLSv1.2; - ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS_AES_256_GCM_SHA384:TLS-AES-256-GCM-SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS-CHACHA20-POLY1305-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA;
After you save the file, make sure that the message says "configuration is valid" or "configuration successful". Otherwise you might need to only add ciphers without bumping TLS versions.
Hopefully it'll save you some trouble.
PS. Alternatively, here are some other ciphers that worked for us when dealing with CloudFlare as DNS and proxy:
What do you think about this?
Wondering what our community has been up to?