SSL Protocol errors in Safari 8 only

yauh · October 30, 2014, 8:15am

Hello community,

I have recently made some changes to my SSL configuration (using nginx with PHP FPM) to increase my rating on SSL Server Test (Powered by Qualys SSL Labs).
Now I observe issues with Piwik 2.8.3 in Safari 8.0 (10600.1.25). Chrome and Firefox show no problems at all.

I can access the dashboard for all sites and settings without any problems, but as soon as I try to open details for a single site I get a protocol error NSPOSIXErrorDomain: 100 and Safari shows nothing but the error.

I can open this link:
https://piwik.domain.org/index.php?module=UsersManager&action=userSettings&idSite=1&period=day&date=yesterday

But I cannot open this one (protocol error):
https://piwik.domain.org/index.php?module=CoreHome&action=index&date=yesterday&period=day&idSite=3

Has anyone else seen a similar issue yet? I know too little about PHP specifics to tell whether there is something wrong on the PHP side of things or my nginx configuration is faulty. I am only running Node.JS behind nginx, so I would like to keep it as it is also my reverse proxy for a couple of other sites, so switching to Apache would not be an option (I’d rather use Piwik exclusively with Chrome).

You can find my current configuration in this gist:

gist.github.com

https://gist.github.com/yauh/68c460b7659569ee7a86

fastcgi_param

#/etc/nginx/fastcgi_param
fastcgi_param	QUERY_STRING		$query_string;
fastcgi_param	REQUEST_METHOD		$request_method;
fastcgi_param	CONTENT_TYPE		$content_type;
fastcgi_param	CONTENT_LENGTH		$content_length;

fastcgi_param	SCRIPT_FILENAME		$request_filename;
fastcgi_param	SCRIPT_NAME		$fastcgi_script_name;
fastcgi_param	REQUEST_URI		$request_uri;
fastcgi_param	DOCUMENT_URI		$document_uri;

This file has been truncated. show original

php-fpm.conf

;;;;;;;;;;;;;;;;;;;;;
; FPM Configuration ;
; /etc/php5/fpm/php-fpm.conf
;;;;;;;;;;;;;;;;;;;;;

; All relative paths in this configuration file are relative to PHP's install
; prefix (/usr). This prefix can be dynamically changed by using the
; '-p' argument from the command line.

; Include one or more files. If glob(3) exists, it is used to include a bunch of

This file has been truncated. show original

piwik.domain.org.conf

#/etc/nginx/sites-enabled/piwik.domain.org.conf
######## NGINX PIWIK SITE CONFIGURATION ##############
server {
    listen 80;
    server_name piwik.domain.org;
    return 301 https://$host$request_uri; # all requests should be https
}

server {
    listen 443 ssl spdy; # ssl and spdy enabled

This file has been truncated. show original

Any help is appreciated

matthieu · November 6, 2014, 5:38am

Hi there, Sorry i have no idea - maybe it’s a bug in the browser? Or if it’s a bug in piwik, we would need more information to find out.

wanah · April 24, 2015, 4:39pm

Hello,

I’ve just come accross the same error and I have a bit more info about the issue.

I’m getting this error with Safari 8 . 0 . 5 (10600.5.17)

It happens with the webserver is compatible with SPDY or HTTP/2 protocol.

Piwik is the only script that it happens on.

It doesn’t happen if you call an image file, just when you call the index.php pwik script. I think it could be related to Piwik’s cookie.

If it a bug with Safari, it doesn’t explain why Piwik seems to be the only script affected.

If I trun of SPDY & HTTP / 2 the error goes away and it works.

yauh · April 24, 2015, 4:55pm

That sounds reasonable - SPDY being to blame.
I have actually moved on from Safari and use Piwik with Chrome exclusively now.

wanah · April 24, 2015, 4:57pm

I’m currelty looking into removing HttpOnly from piwik’s cookie to see if that is what is causing the issue or not…

matthieu · April 25, 2015, 10:42pm

Hi guys,

thank you for the report. It’s definitely something we’d like to follow up: make Piwik work well with Safari is important.

Do you mind creating an issue on the issue tracker? Issues · matomo-org/piwik · GitHub
maybe we could continue the discussion there and this way the product team won’t forget about this issue

wanah · May 8, 2015, 5:58pm

We’ve posted a new issue, and I have sent you a URL where to can see the issue by PM.

matthieu · July 15, 2015, 5:25am

If anyone knows how to fix this issue, we would love to hear in: SPDY errors with Safari 8 + Piwik admin · Issue #7867 · matomo-org/piwik · GitHub

matthieu · July 15, 2015, 11:41am

Hi everyone

do you still have the problem with latest Piwik and latest safari version? if so, please leave a comment in the bug report: SPDY errors with Safari 8 + Piwik admin · Issue #7867 · matomo-org/piwik · GitHub