I have a problem that bothers me for few days. I have 2 local servers on same IP, at my office, on one we run an apache webapp that uses port 443 and port 80, and on the other one i tried to install ubuntu iredmail server, all good until i asked for a letsencrypt certificate, and tried to open the mail domain url. I changed the ssl port in 00-default-ssl.conf to 8443, i stopped the nftables, no firewall installed or active on the mail server, just the pfsense working on network level. if i try to open the mail domain with port 8443 i get the no page, if i try to run with 443 i cant connect to it. If i try to open the main domain, not the mail, the root domain, with default port for ssl i get the page from the other server that runs the apache app, that should be linked to another domain.
I tried to obtain a ssl and i got an error that says the cert cant be downloaded on the server due to a possible firewall misconfiguration. I readout somewhere that pfsense might be the culprit, because he cant read the redirects from request header.
Can you please help me fix it ? I start loosing my patience.
I am trying to install iredmail on a local server with static IP and pfsense.
Related
i have installed a PLEX media server on my NAS an want to install my issued SSL certificate for my custom domain name (eg. customdomain.ddns.net).
I have setup PLEX media server running on port 32400 (default) and setup the port forwarding on my router for external access.
Then i followed the instructions on this page: https://blog.stefandroid.com/2021/08/27/plex-with-lets-encrypt-certificate.html but using an ordered certificated for 1 year.
The domain name is issued and setup correctly and i created a valid .p12 file from the certificate.
I entered all the information on the "Network" settings page in PLEX. But when i open up plex via my custom domain with port 32400 (https://customdomain.ddns.net:32400) i still get an certification error:
This server could not prove that it is customdomain.ddns.net.
Its security certificate is from *.17ed1f92d4c64c4cb135d9dd79589f7e.plex.direct.
Does anyone has a clue what am i doing wrong? And i don't want to use a reverse nginx proxy, cause that is not possible with my setup.
Thanks!
Problem is that faced was when we pointed the DNS to ELB, It was not able to get certificate validation from LetsEncrypt however it worked when we did edited DNS to EC2 servers IP. --> This is OK if we have one server but what if we have many servers it won't work. Hence, we want this LetsEncrypt to
Letsencrypt still needs to use port 80.
If your ELB is only forwarding port 443 for normal traffic you can use the following approach.
Forward port 80 to a small instance only running NGINX and certbot.
Initiate the cert renewal process from the this NGINX box.
Upload cert from NGINX box to ELB.
For extra points you can normally have port 80 disabled on your ELB and only open it when doing the renewal request.
Example setup is here:
https://blog.cloudinvaders.com/installing-a-lets-encrypt-certificate-on-an-elastic-load-balancer/
I am able to reach my weblogic console over https connection but when I try to launch developer console that is setup as a managed server in the weblogic domain, it fails. However, I can reach the dev console over http port without any issues.
I checked the validity of certs installed my keystore and configured to enable ssl port in managed servers. I am not sure what I am missing here. Please advice if I am missing any additional checks/setups.
For eg,
http://<XXX.cname.com>:9005/console - works on http
https://<XXX.cname.com>:9009/edq - does not work on https
I verified from console that ports are right and ssl ports are enabled.
I have a virtual server with a few websites on it. To be honest I know next to nothing about SSL. When Itry to log in to my servers Web Host Manager or any of my sites Cpanels I get a screen (In chrome) saying "This website is not trusted". Is this because the server needs to have SSL installed on it?
Maybe it's not even to do with SSL, but any explanation is appreciated.
SSL secures your conecction between your browser and the server. If you have important data there you should install SSL to protect your connection from "sniffing".
SSL is network protocol so you have to install it or enable it on the server.
here is resource for installing/enabling SSL on Apache server:
http://www.digicert.com/ssl-certificate-installation-apache.htm
and here is how to install/enable SSL on IIS:
http://support.microsoft.com/kb/299875
I am trying to set up an HTTPS site on IIS 7. I have added the certificate, set up the appropriate bindings and the site is accesible from within my company's intranet, however no one from the outside internet can access it. I have a 1:1 NAT forward set up for port 443 that should route requests to the IP address for my server. I have the same situation for port 80 and don't have any issues with http sites being accessible.
Any suggestions for what I might be missing here?
UPDATE:
As it turns out, the company that manages my company's firewall had added the exception for https and 443, and the correct routing, but hadn't added an exception for the process that handles https.
For starters, from outside, use telnet to see if you can even get to the port from outside:
telnet <host name or ip> 443
Note the space before the port.
If the telnet screen goes fully black, w cursor in top left, you can connect, so it is an iis issue.
If telnet just sits there, it is trying to connect but can't. It may finally throw "connection refused" or "could not connect." This means the problem is on the physical firewall (which needs the inbound path opened) or on the iis server itself (in its firewall or iis config)
In this case, next step:
Do the telnet operation on the IIS server itself, and from the same network as IIS (e.g. not through the firewall).
-- If this works: The problem is the network firewall config
-- If this does not work, you need to check the firewall on the IIS server itself (the windows firewall), and the IIS config itself
Note, on windows 7 and vista, telnet may not be present out of the box. Google how to enable it.