How do I troubleshoot SSL handshake issues with HAProxy, ACME,
Cloudflare, OPNsense?
reddit / selfhosted

----------------------------------------------------------------------
TheCheeks · 2023-09-28 21:04

I'm definitely a noob with this stuff. I used to use Nginx Proxy
Manager in docker on unraid, but I wanted to move this service to my
OPNsense box instead... didn't realize it's 100x more complicated.

I've followed this tutorial
(https://forum.opnsense.org/index.php?topic=23339.0). The cert is
created, it gets a B grade so the cert creation worked. I'm using
127.0.0.1 for the "SSL_server" instead of the virtual IP in the
tutorial, they mention you can do this in the FAQ section. However
when I go to the subdomain owncloud.[whatever].com, Cloudflare
complains there's an error on the host side, an SSL Handshake error
525. and yes I have a line in the map:
> owncloud    owncloud_backend

How do I troubleshoot this? How do I figure out where it's getting
hung up? HAProxy doesn't seem to be logging anything either.

----------------------------------------------------------------------
TerminalFoo · 2023-09-29 00:16

You troubleshoot this 1 piece at a time. Work from internal services
to external.

1. Is the service working? Can you access it without SSL?
2. Is NPM working by itself?
3. Is NPM proxying to the service without SSL? Get this working first.
4. Is NPM getting an SSL cert? Get this working next.
5. Is NPM proxying with SSL? Next.
6. And work your way through to the next layer and the next layer.