Self Signed Wildcard Cert with Nginx reddit / selfhosted ---------------------------------------------------------------------- darthrater78 · 2023-12-23 23:20 Having a hell of the time getting this to work. I have a windows CA, and created a wildcard cert for my domain. I export the cert, and the key, upload to ngnix, and create the host/port. Then assign the cert profile I created. I update my internal DNS to point to the nginx server, and try to access the resource and it doesn't work. My wildcard only has itself in the path, and I THINK I have to have the root CA in there somewhere, but I don't know the process. I have it working with duckdns, which I think has obfuscated way too much of the process for me to fully understand it. ---------------------------------------------------------------------- ericesev · 2023-12-23 23:28 It's a bit unclear what you've done. "Self Signed" implies there is no CA, so I'm not following what was done with the windows CA. At any rate, if the browser doesn't trust the CA or the Self Signed certificate then you'll see errors. Make sure the browser trusts the certificate. ---------------------------------------------------------------------- darthrater78 · 2023-12-23 23:39 Sorry my terms are wrong. I have an internal CA. I used that to create my wildcard. I exported the private key from the wildcard and uploaded both the cert and key. Let's encrypt doesn't support my registrar, Hover. ---------------------------------------------------------------------- ericesev · 2023-12-23 23:43 Do you have a screenshot of the problem? FWIW you can continue to use Hover as your registrar and host your DNS with Cloudflare (or another service). The two things, DNS registrar & DNS hosting, should be separate. https://help.hover.com/hc/en- us/articles/217282477--Changing-your-domain-nameservers ---------------------------------------------------------------------- darthrater78 · 2023-12-23 23:47 I'll then have to pay for hosting, won't I? As for the error, it just "refuses the connection " Does the root need to be installed on nginx in any way? ---------------------------------------------------------------------- ericesev · 2023-12-23 23:51 >I'll then have to pay for hosting, won't I? No, Cloudflare DNS hosting is free. And you can keep any web hosting you currently have with Hover. >As for the error, it just "refuses the connection " I suspect this means Nginx is failing to start. Is there anything helpful in the Nginx logs? >Does the root need to be installed on nginx in any way? The root certificate is typically included, yes. Not the root's private key though. ---------------------------------------------------------------------- darthrater78 · 2023-12-23 23:52 So I probably need to concatenate together my root and my wild card cert? And provide the key for the wild card. Unfortunately, cloudflare doesn't proxy MX record so if I were to use that it would break my mail services. ---------------------------------------------------------------------- ericesev · 2023-12-23 23:56 >So I probably need to concatenate together my root and my wild card cert? And provide the key for the wild card. I suspect this is correct. That's what I'd try at least. >Unfortunately, cloudflare doesn't proxy MX record so if I were to use that it would break my mail services. It doesn't need to proxy them. The exact same MX records can simply be added to records in CF and nothing will change with mail delivery. ---------------------------------------------------------------------- darthrater78 · 2023-12-23 23:57 Okay awesome! Thanks for your guidance here. I'll try both ways and see if I can get to work. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-24 08:38 I think youare confusing self signed certificates with a dummy CA with official accredited certification authorities like Letsencrypt who issue official domain certificates. Self signed certificates don't have any trust chain that is recognised by browser manufacturers. ---------------------------------------------------------------------- darthrater78 · 2023-12-24 16:05 A self signed cert is a device that's been signed by "itself" for https. I'm using a private CA to issue certs, so not exactly self signed. I was clumsy in my initial wording. ---------------------------------------------------------------------- darthrater78 · 2023-12-24 16:06 u/ericesev, thanks the the guidance here. I got it working. I had two errors: My cert concatenation was backwards, AND my dns records were pointing towards my docker instance, not my nginx LXC. ---------------------------------------------------------------------- ericesev · 2023-12-24 16:10 It's always DNS :) Glad to hear you got it going. Happy Holidays! ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-24 19:27 Define private cert... I assume it is a self generated certificate with ca authority constraints set to true ...