Issue Clarification Required – SSL It! Extension Loading Issue in Plesk Linux

[Thomas Oryon]

Server operating system version

RHEL 9

Plesk version and microupdate number

18.0.81

Hello All,

We are experiencing an issue with the SSL It! extension on our Plesk Linux servers.

When accessing SSL It! from the Administrator panel, the page takes more than 5 minutes to load and displays the following error:

Error:
+++
Could not get Mozilla TLS config: cURL error 28: Failed to connect to ssl-config.mozilla.org port 443: Connection timed out.
+++

We have investigated and identified that the extension is attempting to access the following URL:

https://ssl-config.mozilla.org/guidelines/4.0.json

However, we have observed that this issue occurs only in the Administrator panel. The SSL functionality works fine in both the Reseller and Customer panels.

We would appreciate your clarification on the following points:

1. SSL It! and Let's Encrypt: We are already using Let's Encrypt to issue and manage SSL certificates. Why is the SSL It! extension required, and what additional functionality does it provide?
2. Administrator Panel Only: Why does this error occur only when accessing SSL It! from the Administrator panel, while the Reseller and Customer panels work without any issues?
3. Mozilla TLS Configuration: Why does SSL It! attempt to fetch the Mozilla TLS configuration only when accessed from the Administrator panel? Is this connection mandatory for SSL certificate installation and management?
4. Required URLs: Could you please provide the complete list of external URLs/FQDNs required by the SSL It! and Let's Encrypt extensions on Plesk Linux servers? We need this information to configure the necessary outbound firewall allowlist.

For your reference, we have attached screenshots of the error.

Kindly review and clarify the above points.

Awaiting your reply.

 

[Sebahat.hadzhi]

Hi, @Thomas Oryon . The issue you are experiencing is likely related to a firewall rule blocking the connection to the network used by ssl-config.mozilla.org. You can also test connectivity directly with curl -v https://ssl-config.mozilla.org/guidelines/4.0.json from the server.

If the existing network block cannot immediately be removed, temporary ACCEPT rules can be placed before the DROP rule for the currently resolved destination addresses and TCP port 443.

For example:

# iptables -I OUTPUT 2 -d 185.199.108.153/32 -p tcp --dport 443 -j ACCEPT
# iptables -I OUTPUT 2 -d 185.199.109.153/32 -p tcp --dport 443 -j ACCEPT
# iptables -I OUTPUT 2 -d 185.199.110.153/32 -p tcp --dport 443 -j ACCEPT
# iptables -I OUTPUT 2 -d 185.199.111.153/32 -p tcp --dport 443 -j ACCEPT

SSL It! and Let's Encrypt: We are already using Let's Encrypt to issue and manage SSL certificates. Why is the SSL It! extension required, and what additional functionality does it provide?

Let’s Encrypt is a certificate authority (CA). SSL It! acts as a centralized dashboard and control center to manage, issue, and harden SSL/TLS certificates for your websites.

Administrator Panel Only: Why does this error occur only when accessing SSL It! from the Administrator panel, while the Reseller and Customer panels work without any issues?

Mozilla TLS Configuration: Why does SSL It! attempt to fetch the Mozilla TLS configuration only when accessed from the Administrator panel? Is this connection mandatory for SSL certificate installation and management?

The Administrator view includes server-wide SSL/TLS settings, such as protocol and cipher recommendations. SSL It! compares these against Mozilla’s published “modern/intermediate” guidelines, which it downloads from https://ssl-config.mozilla.org/guidelines/4.0.json.

Required URLs: Could you please provide the complete list of external URLs/FQDNs required by the SSL It! and Let's Encrypt extensions on Plesk Linux servers? We need this information to configure the necessary outbound firewall allowlist.

I believe those should be:

acme-v02.api.letsencrypt.org
acme-staging-v02.api.letsencrypt.org
ssl-config.mozilla.or