Transfer cert from raspberry to windows

NvBgm · January 31, 2024, 3:55pm

My domain is: https://nvbgm.nl and https://nvbgm1.nl

My web server is (include version): Local pc window 10 and raspberry

The operating system my web server runs on Windows 10 is Local pc

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.8.0

I run Domoticz on a Raspberry P4 certificated with LetsEncrypt
Al runs verry smooth but i want to change it to a Windows 10 pc.
I have all ready instalt Certbot on the window pc and want to get a certification on it for both domain names nvbgm.nl and nvbgm1.nl and ofcource the www.xx
Can anyone help me on what to do next?

9peppe · January 31, 2024, 4:00pm

You should really use a Windows acme client instead of certbot.

rg305 · January 31, 2024, 4:04pm

The simplest solution is to route the HTTP connections directly to the Windows PC.
There you can use a Windows ACME client [not certbot(for Windows)] to obtain the certs via HTTP-01 authentication.
That said, simplest is generally not the most secure option.

If you still plan on serving content from the Pi, then you may have to share the HTTP(S) ports.
The is normally done by placing one [or all] of the web servers behind a reverse proxy.
[I would use `nginx` for that task]

webprofusion · February 1, 2024, 2:13am

I note that the developers don't recommend connecting this to the internet:

github.com

domoticz/domoticz/blob/development/SECURITY_SETUP.md

# Domoticz Security Setup

_Applies to version: 2023.1 and up_

This document describes the security options within Domoticz.

By default, any Domoticz installation gets a default User/Password for an _admin_ user as basic protection for the netwerk it is placed in. 

__NOTE__: _First thing to do is changing the default password into something else!_

Usually that network would be someone's private network at home, work, school, barn, car, etc. And for many, if not most, use-cases that is sufficient and what we want. The goal is to measure and control things within the local environment.

But it is a __bad__ idea to connect any installation directly to the internet, as that would mean __anyone anywhere__ can access Domoticz and control connected devices. Could be _fun_ in some edge-cases, but most likely not what anyone would want.

The same applies for _larger_ networks, for example a school or an office, where you do not want just anyone that has access to the network, also get access to Domoticz. Schoolkids would probably love it, but teacher and staff probably not :)

There are a number of 'components'/'functions' involved when it comes to Domoticz security:

* Users
* Trusted networks

This file has been truncated. show original

I would suggest using tailscale to get a private VPN to access your system remotely.

NvBgm · February 1, 2024, 12:24pm

Hey guys,
I uninstalled certsbot again and started working with win-acme.
Very easy application but I don't get a certificate.
Could it be that I am behind a VPN?
I get this message.

Plugin Manual generated source nvbgm.nl with 4 identifiers
Plugin Single created 1 order
[nvbgm.nl] Authorizing...
[nvbgm.nl] Authorizing using http-01 validation (SelfHosting)
[nvbgm.nl] Authorization result: invalid
[nvbgm.nl] {"type":"urn:ietf:params:acme:error:connection","detail":"22.22.22.222: Fetching http://nvbgm.nl/.well-known/acme-challenge /x5n0OTT4AwdfWdggT5D38e3CTxbxGH2eJ3Ob_QYhY: Connection refused","status":400,"instance":null}
[nvbgm.nl] Deactivating pending authorization
[nvbgm1.nl] Deactivating pending authorization
[www.nvbgm.nl] Deactivating pending authorization
[www.nvbgm1.nl] Deactivating pending authorization

Create certificate failed, retry? (y/n*)

MikeMcQ · February 1, 2024, 1:56pm

This looks like something wrong with your config for port 80. HTTPS (port 443) for your domain works fine but HTTP (port 80) does not. HTTP is needed for the HTTP Challenge

curl -I https://nvbgm.nl
HTTP/1.1 200 OK
Content-Length: 73943
(other headers omitted)

curl -I http://nvbgm.nl
curl: (7) Failed to connect to nvbgm.nl port 80 after 102 ms: 
Connection refused

rg305 · February 1, 2024, 3:29pm

Please explain.

webprofusion · February 2, 2024, 3:58am

For HTTP validation to work http requests to your server TCP port 80 need to work or at least reach your machine (not just HTTPS, TCP 443). Fix that and I would expect everything else will start working again.

As you previously used your raspberry pi I would assume you had some sort of routing setup to forward external port 80 requests through to the IP of that device, so make sure you're now sending them through to the windows machine instead, and that windows firewall has both TCP port 80 and TCP port 443 open.

NvBgm · February 2, 2024, 12:27pm

Thanks i did set the firewall settings correct and it seem to work now .

system · March 3, 2024, 12:27pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.