Lighttpd

Ubuntu recently upgraded libssl1.1 for Ubuntu 18.04LTS and that made lighttpd behave badly. I managed to download the old libssl1.1-1.1.1-1ubuntu2.1~18.04.1 DEB but it did't fix the problem for some reason (perhaps the package updates more than the .so, I'll have to get back regarding that).

Anyway I rebuilt lighttpd for libssl1.0 and that made it work again (ubuntu 18.04 carry both 1.1 and 1.0), anyway when running cURL on a server where it didn't work it seams that lighttpd/libssl sends some extra bytes:

henrik@kobol:~/utveckling/Millistream/applications/mda$ curl "https://packages.millistream.com/" -o /dev/null -sv
*   Trying 85.159.94.206...
* TCP_NODELAY set
* connect to 85.159.94.206 port 443 failed: Förbindelsen förvägrad
*   Trying 195.242.43.117...
* TCP_NODELAY set
* Connected to packages.millistream.com (195.242.43.117) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* (304) (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* (304) (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, Unknown (8):
{ [25 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, Certificate (11):
{ [2822 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* (304) (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* (304) (OUT), TLS Unknown, Certificate Status (22):
} [1 bytes data]
* (304) (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using unknown / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=*.millistream.com
*  start date: May 11 00:00:00 2018 GMT
*  expire date: May  5 12:00:00 2020 GMT
*  subjectAltName: host "packages.millistream.com" matched cert's "*.millistream.com" 
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=RapidSSL RSA CA 2018
*  SSL certificate verify ok.
} [5 bytes data]
* (304) (OUT), TLS Unknown, Unknown (23):
} [1 bytes data]
> GET / HTTP/1.1
> Host: packages.millistream.com
> User-Agent: curl/7.58.0
> Accept: */*
> 
{ [5 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* (304) (IN), TLS Unknown, Certificate Status (22):
{ [1 bytes data]
* (304) (IN), TLS handshake, Newsession Ticket (4):
{ [265 bytes data]
* (304) (IN), TLS Unknown, Unknown (21):
{ [1 bytes data]
* (304) (IN), TLS alert, Client hello (1):
{ [2 bytes data]
* Empty reply from server
* Connection #0 to host packages.millistream.com left intact

vs how the same request looks when it does work:

henrik@kobol:~/utveckling/Millistream/applications/mda$ curl "https://packages.millistream.com/" -o /dev/null -sv
*   Trying 85.159.94.206...
* TCP_NODELAY set
* connect to 85.159.94.206 port 443 failed: Förbindelsen förvägrad
*   Trying 195.242.43.117...
* TCP_NODELAY set
* Connected to packages.millistream.com (195.242.43.117) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* (304) (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* (304) (IN), TLS handshake, Server hello (2):
{ [93 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2817 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [365 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [102 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.millistream.com
*  start date: May 11 00:00:00 2018 GMT
*  expire date: May  5 12:00:00 2020 GMT
*  subjectAltName: host "packages.millistream.com" matched cert's "*.millistream.com" 
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=RapidSSL RSA CA 2018
*  SSL certificate verify ok.
} [5 bytes data]
> GET / HTTP/1.1
> Host: packages.millistream.com
> User-Agent: curl/7.58.0
> Accept: */*
> 
{ [5 bytes data]
< HTTP/1.1 200 OK
< Content-Type: text/html; charset=utf-8
< Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
< X-Frame-Options: DENY
< Content-Length: 7059
< Date: Mon, 17 Jun 2019 12:40:58 GMT
< Server: lighttpd/1.4.54
< 
{ [7059 bytes data]
* Connection #0 to host packages.millistream.com left intact