I have setup LibreNMS following the install guide using nginx as the web server which works fine. I can access this internally on its private IP.
I have a requirement to setup external access to the server using HTTPS which i need assistance with please. I have purchased a certificate and have the .pem file and the private key file. Created a new directory in /etc/nginx/ssl, sorted permissions and put both the certificate files here. I have edited the /etc/nginx/conf.d/librenms.conf file to contain the following information and restarted nginx but i still can’t access it on HTTPS.
Well, it’s not really clear what you’re seeing when you try to access it over HTTPS. Does it connect at all? Throw cert errors? Display something but not the LibreNMS app?
It looks like you’re server{} block is missing the PHP/PHP-FPM config though. Should be pretty close the http example in the install docs.
If you can, I would try to use the curl command on your client device to see what’s really going on. Try it against both http and https and see what the output is. The browser output just isn’t that clear, to me at least. Curl should let you see if it actually connects, what if any cert if presented, resolution, etc.
Yeah, that’s tricky. Getting outside of my area of expertise here, but my understanding of that message is that it’s saying the server doesn’t support RFC5746 (secure renegotiation) so it tried to do insecure renegotiation (which OpenSSL 3+ doesn’t allow). That could be the case if your webserver is an old version. But it’s also possible that something in the middle is interfering and doesn’t allow renegotiation. Like a corporate proxy, firewall with SSL/TLS inspection, client-side firewall, VPN client, etc.
Do you get the same result on both outside of the DNAT firewall you mentioned and when connection to the webserver directly?
Hmm ok so interestingly I read up that this error is common on Ubuntu 22.04.
I changed the openssl.cnf file and added Options = UnsafeLegacyRenegotiation
within the [system_default_sect] section and now it doesn’t show this error, but a different one.
It also shows the certificate from the firewall and not the server?
Vigor Router provides NAT settings, such as Port Redirection and Open Ports, to redirect connection requests on the WAN to an internal server on the LAN. However, when it comes to HTTPS requests, which uses TCP port 443, we need not only the NAT setup but also changing the router’s HTTPS and SSL VPN service port, because those functions are also listening on TCP port 443 by default and they have higher priority than the NAT settings.
To be absolutely certain I have changed the management ports and SSL VPN ports as per your link and low and behold when i run the curl command to check, it actually shows the correct certificate now, and not Drayteks certificate, but i also see the output of the index.php file as per the below, where i didn’t before. Is this normal?
old SSL session ID is stale, removing
< HTTP/1.1 200 OK
< Server: nginx/1.18.0 (Ubuntu)
< Date: Mon, 17 Jun 2024 11:39:27 GMT
< Content-Type: application/octet-stream
< Content-Length: 1739
< Last-Modified: Mon, 29 Apr 2024 15:39:00 GMT
< Connection: keep-alive
< ETag: “662fbf14-6cb”
< Accept-Ranges: bytes
<
<?php
use Illuminate\Contracts\Http\Kernel;
use Illuminate\Http\Request;
define('LARAVEL_START', microtime(true));
/*
|--------------------------------------------------------------------------
| Check If Application Is Under Maintenance
|--------------------------------------------------------------------------
|
| If the application is maintenance / demo mode via the "down" command we
| will require this file so that any prerendered template can be shown
| instead of starting the framework, which could cause an exception.
|
*/
if (file_exists(__DIR__ . '/../storage/framework/maintenance.php')) {
require __DIR__ . '/../storage/framework/maintenance.php';
}
/*
|--------------------------------------------------------------------------
| Register The Auto Loader
|--------------------------------------------------------------------------
|
| Composer provides a convenient, automatically generated class loader for
| this application. We just need to utilize it! We'll simply require it
| into the script here so we don't need to manually load our classes.
|
*/
require __DIR__ . '/../vendor/autoload.php';
/*
|--------------------------------------------------------------------------
| Run The Application
|--------------------------------------------------------------------------
|
| Once we have the application, we can handle the incoming request using
| the application's HTTP kernel. Then, we will send the response back
| to this client's browser, allowing them to enjoy our application.
|
*/
$app = require_once __DIR__ . '/../bootstrap/app.php';
$kernel = $app->make(Kernel::class);
$response = tap($kernel->handle(
$request = Request::capture()
))->send();
$kernel->terminate($request, $response);
* Connection #0 to host mywebsite.co.uk left intact
But it seems now when i browse to https://nms.mywebsite.co.uk, the browser just downloads the index.php as a file and doesn't actually execute it.
I've googled this issue separately and tried some recommended guides to fix it but still doesn't work.
Do you have any clues? If you need to see any config please just ask and I can provide.
Apologies for sounding like a noob here but I'm new to Librenms and new to ubuntu so i'm trying to learn as I go.
Thanks,
James
include snippets/ssl-example.com.conf;
include snippets/ssl-params.conf;
in my nginx config file, but this is a little confusing as there only files in the snippets directory is: fastcgi-php.conf and snakeoil.conf. I did try pointing the include directory to these two files but that didn’t work either.
I’ve actually changed the config to be:
include /etc/nginx/snippets/fastcgi-php.conf;
include /etc/nginx/fastcgi_params;
Which tells you the location of the files to parse to the user, so i simply copied this peace of code into the port 443 server block and restarted nginx service. I can now browse to libre from https using an FQDN with the correct certificate installed.
Thanks for all your help with this its appreciated.
