Nginx Proxy Manager Cert issue
reddit / selfhosted

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 13:59

so i am testing NPM out and created a test domain in cloudflare. I
already have a working setup using HAProxy on my opnsense so i know
things work.

here is the issue and im really scratching my head here. in NPM i
added my portainer service and used LE to issue the cert. changed the
forwarded address to my NPM server and all seems to go well.
Internally (split dns) i can hit the domain and see the LE cert.
however, if i use my phone (even turning it into a hotspot for my
laptop) when i go to my portainer sub domain, i get a cert issued by
google.

i can't figure out or understand why. can anyone shed some light?

----------------------------------------------------------------------
ElevenNotes · 2023-11-04 14:05

Do you get the full chain or only the cert for the CN via external
access to NPM?

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 14:16

i do see the public key, signature and finger prints if that's what
you are asking (sorry, limited knowledge here). really appreciate the
help

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 14:24

so found a site to check. looks like it sends back the full chain.

server
common name and SANs are correct


chain
Common name: GTS CA 1P5
Organization: Google Trust Services LLC

chain
Common name: GTS Root R1
Organization: Google Trust Services LLC

----------------------------------------------------------------------
thekrautboy · 2023-11-04 14:43

Thats because your phone is using a different DNS.

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 14:48

well yes. that is the reason to go from outside your network to test.
but regardless if its internal or external, the expectation is to have
the same cert delivered, and it's not

----------------------------------------------------------------------
clintkev251 · 2023-11-04 14:51

Not if the connection is being proxied by Cloudflare, is it?

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 14:55

yes, but i did try it both on and off

----------------------------------------------------------------------
RollTide_1717 · 2023-11-04 21:15

with all the changes etc i was making. i left it alone for a few
hours. i think you are right. with proxy enabled i get a google cert.
even on my HAProxy nextcloud site. so i guess i can assume this is
normal?

----------------------------------------------------------------------
clintkev251 · 2023-11-04 23:13

Still seems weird to me that it's a google cert, but the fact that the
cert is not owned by you when proxied through Cloudflare is expected,
as they present their own cert at the edge, then terminate and re-
encrypt your traffic before sending it on to your origin