[GH-ISSUE #2286] HTTPS with SSL certificate not working #1817

New issue

Closed

opened 2026-05-05 13:10:26 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 13:10:26 -06:00

Owner

Originally created by @TannerGabriel on GitHub (Mar 8, 2021).
Original GitHub issue: https://github.com/fatedier/frp/issues/2286

[REQUIRED] hat version of frp are you using

Version: 0.35.1

[REQUIRED] What operating system and processor architecture are you using
OS: Ubuntu
CPU architecture: x86

[REQUIRED] description of errors
When trying to forward a service from a local PC using HTTPS with an SSL certificate the service is not accessible. When I visit the domain that I specified I just get a 502 Nginx error code. If I try to access it directly over the IP-Address using IP_ADDRESS:vhost_https_port I get the following error messages:

2021/03/08 13:40:06 [D] [vhost.go:191] [9cc6d8983f363ef0] [axis] get new http request host [axis.hascy.at] path []
2021/03/08 13:40:06 [I] [proxy.go:162] [9cc6d8983f363ef0] [axis] get a user connection [ADDRESS]
2021/03/08 13:40:06 [D] [control.go:248] [9cc6d8983f363ef0] get work connection from pool
2021/03/08 13:40:06 [D] [proxy.go:103] [9cc6d8983f363ef0] [axis] get a new work connection: [ADDRESS]
2021/03/08 13:40:06 [D] [proxy.go:273] [9cc6d8983f363ef0] [axis] join connections, workConn(l[ADDRESS] r[ADDRESS]) userConn(l[ADDRESS] r[ADDRESS])
2021/03/08 13:40:06 [D] [proxy.go:283] [9cc6d8983f363ef0] [axis] join connections closed
2021/03/08 13:40:06 [D] [control.go:219] [9cc6d8983f363ef0] new work connection registered
2021/03/08 13:40:15 [D] [control.go:475] [0fe6663aa0adbbea] receive heartbeat
2021/03/08 13:40:26 [D] [control.go:475] [9cc6d8983f363ef0] receive heartbeat
2021/03/08 13:40:39 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello
2021/03/08 13:40:40 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello
2021/03/08 13:40:43 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 13:40:43 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 13:40:44 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 13:40:44 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 13:40:45 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 13:40:45 [D] [vhost.go:147] get hostname from http/https request error: Unknown error

confile

FRPS:

[common]
bind_port = 7000
vhost_https_port = 8300
vhost_http_port = 8400
authentication_method = token
token = test
subdomain_host = $DOMAIN
log_file = console
# debug, info, warn, error
log_level = debug

FRPC:

[common]
server_addr = ${FRP_SERVER_ADDR}
server_port = 7000
authentication_method = token
token = test
log_file = console
# debug, info, warn, error
log_level = debug
 
[axis]
type = https
local_port=9000
subdomain = axis
health_check_type = tcp
health_check_timeout_s = 3
health_check_max_failed = 3
health_check_interval_s = 10

log file

2021/03/08 14:55:18 [I] [root.go:108] frps uses config file: /tmp/frps.ini
2021/03/08 14:55:18 [I] [service.go:190] frps tcp listen on 0.0.0.0:7000
2021/03/08 14:55:18 [I] [service.go:232] http service listen on 0.0.0.0:8400
2021/03/08 14:55:18 [I] [service.go:253] https service listen on 0.0.0.0:8300
2021/03/08 14:55:18 [I] [root.go:217] frps started successfully
2021/03/08 14:55:18 [I] [service.go:444] [0fe6663aa0adbbea] client login info: ip [IP_ADDRESS] version [0.34.1] hostname [] os [linux] arch [amd64]
2021/03/08 14:55:18 [I] [service.go:444] [09b884a350dc6180] client login info: ip [IP_ADDRESS] version [0.35.1] hostname [] os [linux] arch [amd64]
2021/03/08 14:55:18 [D] [control.go:219] [09b884a350dc6180] new work connection registered
2021/03/08 14:55:18 [D] [control.go:219] [0fe6663aa0adbbea] new work connection registered
2021/03/08 14:55:19 [I] [tcp.go:63] [0fe6663aa0adbbea] [sshasc] tcp proxy listen port [8000]
2021/03/08 14:55:19 [I] [control.go:446] [0fe6663aa0adbbea] new proxy [sshasc] success
2021/03/08 14:55:19 [I] [tcp.go:63] [0fe6663aa0adbbea] [winbox] tcp proxy listen port [8291]
2021/03/08 14:55:19 [I] [control.go:446] [0fe6663aa0adbbea] new proxy [winbox] success
2021/03/08 14:55:19 [I] [tcp.go:63] [09b884a350dc6180] [ssh] tcp proxy listen port [6000]
2021/03/08 14:55:19 [I] [control.go:446] [09b884a350dc6180] new proxy [ssh] success
2021/03/08 14:55:19 [I] [https.go:63] [09b884a350dc6180] [axis] https proxy listen for host [DOMAIN]
2021/03/08 14:55:19 [I] [control.go:446] [09b884a350dc6180] new proxy [axis] success
2021/03/08 14:55:48 [D] [control.go:475] [09b884a350dc6180] receive heartbeat
2021/03/08 14:55:48 [D] [control.go:475] [0fe6663aa0adbbea] receive heartbeat
2021/03/08 14:57:36 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello
2021/03/08 14:57:37 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello
2021/03/08 14:57:41 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 14:57:41 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 14:57:42 [D] [vhost.go:147] get hostname from http/https request error: Unknown error
2021/03/08 14:57:42 [D] [vhost.go:147] get hostname from http/https request error: Unknown error

Steps to reproduce the issue

Setup FRP using the above configs
Use Nginx as a reverse proxy from the domain to the vhost_https_port
Trying to access the service that FRP should forward

Supplementary information

FRP is run using Docker
Nginx-Proxy Docker container is used as a reverse proxy from the domain to the vhost_https_port defined in the FRP config.
I also looked at #1218, but it did not help fix my problem.

Can you guess what caused this issue

Checklist:

I included all information required in the sections above
I made sure there are no duplicates of this report (Use Search)

Originally created by @TannerGabriel on GitHub (Mar 8, 2021). Original GitHub issue: https://github.com/fatedier/frp/issues/2286     **[REQUIRED] hat version of frp are you using**  Version: 0.35.1 **[REQUIRED] What operating system and processor architecture are you using** OS: Ubuntu CPU architecture: x86 **[REQUIRED] description of errors** When trying to forward a service from a local PC using HTTPS with an SSL certificate the service is not accessible. When I visit the domain that I specified I just get a 502 Nginx error code. If I try to access it directly over the IP-Address using IP_ADDRESS:vhost_https_port I get the following error messages: ``` 2021/03/08 13:40:06 [D] [vhost.go:191] [9cc6d8983f363ef0] [axis] get new http request host [axis.hascy.at] path [] 2021/03/08 13:40:06 [I] [proxy.go:162] [9cc6d8983f363ef0] [axis] get a user connection [ADDRESS] 2021/03/08 13:40:06 [D] [control.go:248] [9cc6d8983f363ef0] get work connection from pool 2021/03/08 13:40:06 [D] [proxy.go:103] [9cc6d8983f363ef0] [axis] get a new work connection: [ADDRESS] 2021/03/08 13:40:06 [D] [proxy.go:273] [9cc6d8983f363ef0] [axis] join connections, workConn(l[ADDRESS] r[ADDRESS]) userConn(l[ADDRESS] r[ADDRESS]) 2021/03/08 13:40:06 [D] [proxy.go:283] [9cc6d8983f363ef0] [axis] join connections closed 2021/03/08 13:40:06 [D] [control.go:219] [9cc6d8983f363ef0] new work connection registered 2021/03/08 13:40:15 [D] [control.go:475] [0fe6663aa0adbbea] receive heartbeat 2021/03/08 13:40:26 [D] [control.go:475] [9cc6d8983f363ef0] receive heartbeat 2021/03/08 13:40:39 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello 2021/03/08 13:40:40 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello 2021/03/08 13:40:43 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 13:40:43 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 13:40:44 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 13:40:44 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 13:40:45 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 13:40:45 [D] [vhost.go:147] get hostname from http/https request error: Unknown error ``` **confile**  FRPS: ``` [common] bind_port = 7000 vhost_https_port = 8300 vhost_http_port = 8400 authentication_method = token token = test subdomain_host = $DOMAIN log_file = console # debug, info, warn, error log_level = debug ``` FRPC: ``` [common] server_addr = ${FRP_SERVER_ADDR} server_port = 7000 authentication_method = token token = test log_file = console # debug, info, warn, error log_level = debug [axis] type = https local_port=9000 subdomain = axis health_check_type = tcp health_check_timeout_s = 3 health_check_max_failed = 3 health_check_interval_s = 10 ``` **log file**  ``` 2021/03/08 14:55:18 [I] [root.go:108] frps uses config file: /tmp/frps.ini 2021/03/08 14:55:18 [I] [service.go:190] frps tcp listen on 0.0.0.0:7000 2021/03/08 14:55:18 [I] [service.go:232] http service listen on 0.0.0.0:8400 2021/03/08 14:55:18 [I] [service.go:253] https service listen on 0.0.0.0:8300 2021/03/08 14:55:18 [I] [root.go:217] frps started successfully 2021/03/08 14:55:18 [I] [service.go:444] [0fe6663aa0adbbea] client login info: ip [IP_ADDRESS] version [0.34.1] hostname [] os [linux] arch [amd64] 2021/03/08 14:55:18 [I] [service.go:444] [09b884a350dc6180] client login info: ip [IP_ADDRESS] version [0.35.1] hostname [] os [linux] arch [amd64] 2021/03/08 14:55:18 [D] [control.go:219] [09b884a350dc6180] new work connection registered 2021/03/08 14:55:18 [D] [control.go:219] [0fe6663aa0adbbea] new work connection registered 2021/03/08 14:55:19 [I] [tcp.go:63] [0fe6663aa0adbbea] [sshasc] tcp proxy listen port [8000] 2021/03/08 14:55:19 [I] [control.go:446] [0fe6663aa0adbbea] new proxy [sshasc] success 2021/03/08 14:55:19 [I] [tcp.go:63] [0fe6663aa0adbbea] [winbox] tcp proxy listen port [8291] 2021/03/08 14:55:19 [I] [control.go:446] [0fe6663aa0adbbea] new proxy [winbox] success 2021/03/08 14:55:19 [I] [tcp.go:63] [09b884a350dc6180] [ssh] tcp proxy listen port [6000] 2021/03/08 14:55:19 [I] [control.go:446] [09b884a350dc6180] new proxy [ssh] success 2021/03/08 14:55:19 [I] [https.go:63] [09b884a350dc6180] [axis] https proxy listen for host [DOMAIN] 2021/03/08 14:55:19 [I] [control.go:446] [09b884a350dc6180] new proxy [axis] success 2021/03/08 14:55:48 [D] [control.go:475] [09b884a350dc6180] receive heartbeat 2021/03/08 14:55:48 [D] [control.go:475] [0fe6663aa0adbbea] receive heartbeat 2021/03/08 14:57:36 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello 2021/03/08 14:57:37 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello 2021/03/08 14:57:41 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 14:57:41 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 14:57:42 [D] [vhost.go:147] get hostname from http/https request error: Unknown error 2021/03/08 14:57:42 [D] [vhost.go:147] get hostname from http/https request error: Unknown error ``` **Steps to reproduce the issue** 1. Setup FRP using the above configs 2. Use Nginx as a reverse proxy from the domain to the `vhost_https_port` 3. Trying to access the service that FRP should forward **Supplementary information** - FRP is run using Docker - [Nginx-Proxy](https://github.com/nginx-proxy/nginx-proxy) Docker container is used as a reverse proxy from the domain to the `vhost_https_port` defined in the FRP config. - I also looked at #1218, but it did not help fix my problem. **Can you guess what caused this issue** **Checklist**:  - [X] I included all information required in the sections above - [X] I made sure there are no duplicates of this report [(Use Search)](https://github.com/fatedier/frp/issues?q=is%3Aissue)

gitea-mirror closed this issue

2026-05-05 13:10:27 -06:00

gitea-mirror commented

2026-05-05 13:10:29 -06:00

Author

Owner

@yuyulei commented on GitHub (Mar 12, 2021):

2021/03/08 13:40:39 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello

Is the schema of request that frps received http? Can you try after editing type = http ?

@yuyulei commented on GitHub (Mar 12, 2021): > 2021/03/08 13:40:39 [D] [vhost.go:147] get hostname from http/https request error: readHandshake: type[32] is not clientHello Is the schema of request that frps received `http`? Can you try after editing `type = http` ?

gitea-mirror commented

2026-05-05 13:10:30 -06:00

Author

Owner

@TannerGabriel commented on GitHub (Mar 14, 2021):

Thank you for the response. I tried it out, but no change. I also tried the https2http plugin hoping that might help, but it didn't. Am I right to assume that I can use the LetsEncrypt certificates that I generated for the domain and also use in NGINX?

[axis]
type = https
custom_domains = axis.example.com
plugin = https2http
plugin_local_addr = 127.0.0.1:9000
plugin_crt_path = ./server.crt
plugin_key_path = ./server.key
plugin_host_header_rewrite = 127.0.0.1
plugin_header_X-From-Where = frp

@TannerGabriel commented on GitHub (Mar 14, 2021): Thank you for the response. I tried it out, but no change. I also tried the `https2http` plugin hoping that might help, but it didn't. Am I right to assume that I can use the LetsEncrypt certificates that I generated for the domain and also use in NGINX? ``` [axis] type = https custom_domains = axis.example.com plugin = https2http plugin_local_addr = 127.0.0.1:9000 plugin_crt_path = ./server.crt plugin_key_path = ./server.key plugin_host_header_rewrite = 127.0.0.1 plugin_header_X-From-Where = frp ```

gitea-mirror commented

2026-05-05 13:10:30 -06:00

Author

Owner

@TannerGabriel commented on GitHub (Mar 17, 2021):

Thank you for the help. I just found a workaround for my problem. I now use type = tcp to forward the HTTP traffic and then use an Nginx reverse proxy to get the HTTPS traffic to my service.

@TannerGabriel commented on GitHub (Mar 17, 2021): Thank you for the help. I just found a workaround for my problem. I now use `type = tcp` to forward the HTTP traffic and then use an Nginx reverse proxy to get the HTTPS traffic to my service.