Knowledge Base

All websites hosted in Plesk are not accessible over HTTPS: 502 Bad Gateway or ERR_CONNECTION_REFUSED

Symptoms

Websites hosted in Plesk are loading over HTTP, but do not work over HTTPS:

502 Bad Gateway nginx

ERR_CONNECTION_REFUSED

Cause

The ssl_module is not included into Apache configuration, as a result Apache is not listening on port 7081 (when nginx is enabled in Tools & Settings > Services Management) or 443 port (when nginx is disabled in Tools & Settings > Services Management):

- on CentOS/RHEL-based distributions
  
  # netstat -tunap | grep httpd
  tcp 0 0 0.0.0.0:7080 0.0.0.0:* LISTEN 2647/httpd
- on Debian/Ubuntu-based distributions
  
  # netstat -tunap | grep apache
  tcp6 0 0 :::7080 :::* LISTEN 763/apache2

Resolution

Enable Apache ssl_module:

For CentOS/RHEL-based distributions

Connect to the Plesk server via SSH.
Make sure that the conf.d directory is included in Apache configuration:

# grep IncludeOptional /etc/httpd/conf/httpd.conf
IncludeOptional conf.d/*.conf

If no output is returned or the line has a hash sign "#" at the beginning, open the file /etc/httpd/conf/httpd.conf in any text editor (for example, vi editor) and add/uncomment the mentioned line.
Restore the default ssl.conf file:

3.1. Download the file for your OS and unzip it:
- CentOS/RHEL/CloudLinux 8
  
  # wget https://cpanel.zendesk.com/hc/article_attachments/12377382019607 -O ssl_conf_8.zip
  
  # unzip ssl_conf_8.zip
- CentOS/RHEL/CloudLinux 7
  
  # wget https://cpanel.zendesk.com/hc/article_attachments/12377433751447 -O ssl_conf_7.zip
  
  # unzip ssl_conf_7.zip
3.2. Rename the original file, if exists:

# mv /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.old

3.3. Put the file in the conf.d directory:

# mv ssl.conf /etc/httpd/conf.d/
Restore SELinux context of the file:

# restorecon /etc/httpd/conf.d/ssl.conf
Restart Apache:

# service httpd restart
Verify that Apache is now listening on port 7081:

# netstat -tunap | grep httpd
tcp 0 0 0.0.0.0:7080 0.0.0.0:* LISTEN 17817/httpd
tcp 0 0 0.0.0.0:7081 0.0.0.0:* LISTEN 17817/httpd

For Debian/Ubuntu-based distributions

Connect to a Plesk server via SSH.
Create two symbolic links:
# ln -s /etc/apache2/mods-available/ssl.conf /etc/apache2/mods-enabled/ssl.conf
# ln -s /etc/apache2/mods-available/ssl.load /etc/apache2/mods-enabled/ssl.load
Restart Apache:

# service apache2 restart
Verify that Apache is now listening on port 7081:

# netstat -tunap | grep apache
tcp6 0 0 :::7080:::* LISTEN 2462/apache2
tcp6 0 0 :::7081:::* LISTEN 2462/apache2