A fresh noob needs help for its first certificate

9peppe · March 24, 2020, 11:02am

you removed those lines as well, did you?

    ssl_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vpn.exstasi.ovh/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/chain.pem;

put them back.

and

    include snippets/ssl.conf;

as well. (remove “preload” from the hsts header if you didn’t put it there yourself)

redfirebrooks · March 24, 2020, 11:04am

From where ?
told you, I am lost completly now.

9peppe · March 24, 2020, 11:07am

Recognize this?

You should’ve removed one line. Not five.

server {
    listen 943 ssl http2;
    server_name vpn.exstasi.ovh;

    ssl_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vpn.exstasi.ovh/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/chain.pem;
    include snippets/ssl.conf;
    include snippets/letsencrypt.conf;

location / {
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Nginx-Proxy true;

      proxy_headers_hash_max_size 512;
      proxy_headers_hash_bucket_size 128; 

      proxy_redirect off;
      proxy_buffering off;
      proxy_request_buffering off;
      proxy_connect_timeout 300s;
      proxy_send_timeout 300s;
      proxy_read_timeout 300s;
      send_timeout 10000;

      proxy_pass http://localhost:943;
      proxy_redirect http://localhost:943;
      }

}

(don’t worry, every noob screams at nginx at the beginning)

redfirebrooks · March 24, 2020, 11:13am

But I use to acces the vpn without specifying the port, simply with http://vpn.exstasi.ovh
now http://vpn.exstasi.ovh redirects me to tne nginx default page

9peppe · March 24, 2020, 11:20am

it doesn’t. it tells you there’s an error, in this line

return 301 https://$host$request_uri:943;

edit it, return 301 https://${host}:943${request_uri};

redfirebrooks · March 24, 2020, 11:23am

I don’t get it; not working

server {
  listen 80;
  listen [::]:80;
  server_name vpn.exstasi.ovh;

  return 301 https://${host}:943${request_uri};

  location / {
  proxy_pass http://localhost:943/;
  }
}


server {
listen 943 ssl http2;
server_name vpn.exstasi.ovh;

ssl_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/vpn.exstasi.ovh/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/chain.pem;
include snippets/ssl.conf;

location / {
  proxy_set_header X-Forwarded-Proto https;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $http_host;
  proxy_set_header X-Nginx-Proxy true;

  proxy_headers_hash_max_size 512;
  proxy_headers_hash_bucket_size 128;

  proxy_redirect off;
  proxy_buffering off;
  proxy_request_buffering off;
  proxy_connect_timeout 300s;
  proxy_send_timeout 300s;
  proxy_read_timeout 300s;
  send_timeout 10000;

  proxy_pass http://localhost:943;
  proxy_redirect http://localhost:943;
  }

}

9peppe · March 24, 2020, 11:25am

I'd remove this. I don't think it's supposed to do anything anyway.

redfirebrooks · March 24, 2020, 11:31am

line removed but still no luck
I am redirected to https://vpn.exstasi.ovh/:943 with a 404 Not Found

9peppe · March 24, 2020, 11:33am

the return 301 line is your version or my version?

redfirebrooks · March 24, 2020, 11:51am

yours

server {
  listen 80;
  listen [::]:80;
  server_name vpn.exstasi.ovh;

  return 301 https://${host}:943${request_uri};

}


server {
    listen 943 ssl http2;
    server_name vpn.exstasi.ovh;

    ssl_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vpn.exstasi.ovh/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/vpn.exstasi.ovh/chain.pem;
    include snippets/ssl.conf;

location / {
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-Nginx-Proxy true;

      proxy_headers_hash_max_size 512;
      proxy_headers_hash_bucket_size 128;

      proxy_redirect off;
      proxy_buffering off;
      proxy_request_buffering off;
      proxy_connect_timeout 300s;
      proxy_send_timeout 300s;
      proxy_read_timeout 300s;
      send_timeout 10000;

      proxy_pass http://localhost:943;
      proxy_redirect http://localhost:943;
      }

}

9peppe · March 24, 2020, 11:53am

check /var/log/nginx/error.log

i don’t know, it maybe needs return 301 "https://${host}:943${request_uri}";

redfirebrooks · March 24, 2020, 11:56am

master@vps726152:/etc/nginx/sites-available$ sudo tail /var/log/nginx/error.log
2020/03/24 12:48:29 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:48:29 [emerg] 664#664: still could not bind()
2020/03/24 12:51:32 [error] 12525#12525: *53255 upstream prematurely closed connection while reading response header from upstream, client: 151.29.206.125, server: vpn.exstasi.ovh, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:943/", host: "vpn.exstasi.ovh"
2020/03/24 12:54:21 [notice] 14724#14724: signal process started
2020/03/24 12:54:21 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:54:21 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:54:21 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:54:21 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:54:21 [emerg] 664#664: bind() to 0.0.0.0:943 failed (98: Address already in use)
2020/03/24 12:54:21 [emerg] 664#664: still could not bind()

Anyway, I tried again to sudo certbot --nginx with media.exstasi.ovh which was the initial purpose of my post but I still have the same 404 error.

I have enough trying with no luck. I will reset my VPS and restart from scratch

9peppe · March 24, 2020, 12:03pm

wait. this error is because you have openvpn access server already listening on that port. you can easily solve it. just remove the nginx proxying and install the LE certificates in it too.

(or use openvpn community, I’d say)

redfirebrooks · March 24, 2020, 12:08pm

Sorry but I do not understand.

I wanted to install a certificate for media.exstasi.ovh
I wanted to accces the VPN admin page with vpn.exstasi.ovh
I am really confused now so I think it is better for me to forget everything about it and restart everything step by step or leave it like it is.

9peppe · March 24, 2020, 12:15pm

You want a certificate for media.exstasi.ovh and for vpn.exstasi.ovh on different ports with different softwares.

Just for ease of use, you have redirector on port 80 that allows you not to use port numbers.

You have to do two things:

decouple openvpn and nginx on ssl
install a certificate for vpn.exstasi.ovh into openvpn certbot -a nginx -d vpn.exstasi.ovh --deploy-hook "/path/to/install_into_openvpn.sh"

redfirebrooks · March 24, 2020, 12:16pm

Thanks but I will stop there… I do not acces any more my vpn with the IP adress for example. Everything seems to be broken.

9peppe · March 24, 2020, 12:18pm

stop, relax. find all listen 943 directives in nginx and change that number, 944 should be fine. then reboot the machine.

redfirebrooks · March 24, 2020, 12:21pm

thanks a lot but i am done with it for now.

9peppe · March 24, 2020, 12:35pm

that’s because your nginx config is seriously messed up and nginx and openvpnas fight for control over port 943.

don’t worry too much. you’ll get the config you want, but it takes time and calm. you won’t get there copypasting random tutorials.

redfirebrooks · March 24, 2020, 12:38pm

removing vpn from nginx worked
i was able to install a certificate on media but now I am facing another challenge
i can’t access any of the app behind muximux because they are not served with https
i am getting crazy !!!