SSL certificate installation

[MolbioUnige]

Hi,
I have installed nextpyp on a single server and I cannot access the web interface. The message I receive is that my browser cannot establish a secure connection. It's a headless server, access thru localhost is not an option.
How should I install my SSL certificates?
Thank you for your help
Nicolas

[cuchaz]

If you installed nextPYP with a domain name, the reverse proxy should automatically provision and install a certificate for you. If you didn't use a domain name during installation, the reverse proxy will still generate a certificate, but it won't be trusted by your browser by default. There should be a way to tell your browser to ignore the warnings though if you still want to access the website.

If there's no way to ignore the warnings from your browser, that might indicate that there's a mixup between HTTP and HTTPs traffic. That problem requires a different solution. Do you have any more information about the error message from your browser?

[MolbioUnige]

I unfortunately could not investigate further as the cooling system in our datacenter broken down and we had to shut down all servers. I'll get back as soon as I can.

[cuchaz]

Ouch! Hope you get it fixed soon. Good luck!

[MolbioUnige]

Back on tracks.
I had installed nextPYP with a domain name, I can read it in the config.toml. This is the response I get with curl.

curl -vL https://my.domain.name
*   Trying 10.194.121.34:443...
* Connected to my.domain.name (10.194.121.34) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error
* Closing connection 0
curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error

I checked, and the CAfile /etc/ssl/cert.pem is missing on the server. Is that the certificate that should have been installed?

[cuchaz]

Hmm... looks like Caddy (the reverse proxy server) tried to install a certificate, but that IP address looks like it belongs to a private network? Probably that means Caddy didn't issue a real cert and made a self-signed one instead. If you're on a private network, you might not need to use the reverse proxy server at all and you can just avoid that extra step. Unless you need to access the app website from the internet, then you'll still need to use the reverse proxy server.

We made a lot of improvements and simplifications to the install process in the new v0.5.2 release. Maybe you'd have better luck if you started again with the new install process? It will help you decide if you need to use the reverse proxy server or not, and then show you how to install it if you really need it. Otherwise, it can help get you set up without the reverse proxy server.

[MolbioUnige]

Yes the server is on a private network, but people will need to access it from the network.
After reading the documentation again, I saw that the webinterface was also accessible on plain http on port 8080. That will do for now.
Thank you very much for your help

[MolbioUnige]

I finally reinstalled nextPYP using the latest 0.5.2 version. I followed the instructions by the letter and it went flawless this time.

Still, I noticed something confusing on the installation page section 5. There is an entry about web.local but I can't find any reference to it in the config reference page. Should it be web.localDir?

[abartesaghi]

@MolbioUnige, glad to hear that. You are right about the web.local setting, it should be web.localDir, we will correct this in the docs.