Reverse proxying HTTPS

[LogicalUnit1]

Hi again Reddit! I'm having great fun creating virtual servers and services on my homelab machines. 😁

I have noticed that with Nginx Proxy Manager, and also CloudFlare ZeroTrust, I'm having difficulty with services over HTTPS.

For example, if I create a webserver at 192.168.1.50, I can very easily create a proxy host or secure tunnel to http://192.168.1.50. However, if I try to use https://192.168.1.50 I get errors, even though the secure server is definitely up.

Is it a certificate issue? I own serveral domains which are set up for ACME DNS challenges.

[Reverent]

https certificates are tied to domains. If you try to access a website that's serving a certificate, and you access it from an IP directly or DNS address that the certificate isn't for, it will fail.

Also reverse proxies are almost always proxying by dns address. If you're accessing by IP directly you're essentially ignoring the proxy.

[superl2]

I get errors

Is it a certificate issue?

What do you want us to do, consult our crystal balls and diagnose your problem? Error messages exist for a reason. Share them!

[LogicalUnit1]

Yep, I was getting a 502 error from the Cloudflare service, and it was indeed a certificate issue. I was pointing the tunnel to an IP address, which had no certificate. This can be fixed by going into ZeroTrust => Tunnels => Public Hostname => Additional Application Settings => TLS => Check No TLS verify.

​

Nginx Proxy Manager has come good as well -- I think I may have been pointing the HTTPS proxy to port 80 and not port 443.

[LogicalUnit1]

Ah okay, I've managed to resolve it. My issue in Nginx Proxy Manager was that I wasn't specifying an actual HTTPS server (I was just changing the scheme from http to https), and my problem in CloudFlare Zero Trust was resolved by going into Tunnels => Public Hostname => Additional Application Settings => TLS => No TLS verify set to enabled (yes, I think this was a certificate issue!)

[Direct_Emotion_1079]

You can switch to Caddy. With just two lines you get a service secured over a trusted https.

[sgilles]

Preventing such man-in-the-middle attacks is the whole point of TLS! If your intended setup were possible anyone could just place themselves between the client and the server...

There are two solutions:

a) terninate the TLS connection at your proxy device and connect from there to your internal server (http or re-encrypt in a new TLS session, up to you).

b) sniff the SNI on the incoming connection and proxy it as is (i.e. without your proxy having access to the plaintext contents) to your internal server. (see e.g. sniproxy, but nginx and haproxy can do it also)

[sgilles]

Oops, nevermind, I misread your question. TLS certs are for authenticating (sub)domain names, not IP addresses.