Comment on Traefik conditional certificate for same URL
ramielrowe@lemmy.world 6 months ago
Just serve the CloudFlare certs. If the URL is the same, it won’t matter. Doesn’t matter if you’re talking to a local private address like 192.166.1.100 or a public IP. If you’re accessing it via a DNS name, that is what is validated, not the underlying IP.
shiftymccool@programming.dev 6 months ago
If I use the Cloudflare origin server certs, the browser shows insecure and the message is “certificate not trusted” which is the same message as self-signed, if I’m not mistaken. I’m not sure what other details are relevant as I’m still new-ish to the networking portion of this home server thing. I’m happy to answer any questions if you suspect something.
IHawkMike@lemmy.world 6 months ago
You said Traefik is getting certs from Cloudflare, but do you mean it’s getting Let’s Encrypt certs using a CF DNS challenge? And if that is the case, then your browser should trust the Traefik endpoint since LE certs are publicly trusted.
Are you sure you’re hitting Traefik when you get a cert warning? You need to update your internal DNS if not.
shiftymccool@programming.dev 6 months ago
You’re right, I’m using the cloudflare DNS challenge to get let’s encrypt certs. I’m definitely hitting traefik. I’m testing by turning the Wi-Fi on my phone off/on and opening the page after. I get the same cert every time but it’s not trusted when on Wi-Fi. This makes sense since it’s the origin server cert which is meant to encrypt traffic between my server and cloudflare. To add more certainty, when Wi-Fi is on, a traceroute shows only one hop to my server and shows a bunch of hops when it’s off.
IHawkMike@lemmy.world 6 months ago
If you, Traefik, and your origin server are on the same network, then it’s going to be one hop regardless of whether you’re hitting the Traefik proxy or the origin server. If Traefik is serving up the origin server’s cert and not the LE cert, then Traefik is misconfigured to pass through instead of proxy, but I’m still not sure that’s the case as it’s almost harder to configure it that way than the correct way as a proxy.
What IP:port is your origin server listening on, what IP:port is Traefik listening on, and how is Traefik configured to reach the origin server?
ramielrowe@lemmy.world 6 months ago
I somewhat wonder if CloudFlare is issuing two different certs. An “internal” cert your servers use to serve to CloudFlare, which uses a private CA only valid for CloudFlare’s internal services. CloudFlare’s tunnel service validates against that internal CA, and then serves traffic using an actual public CA signed cert to public internet traffic.
Honestly though, I kinda think you should just go with serving everything entirely externally. Either your trust CloudFlare’s tunnels, or you don’t. If you don’t trust CloudFlare to protect your services, you shouldn’t be using it at all.
shiftymccool@programming.dev 6 months ago
That’s what I’m settling on. However, it’s not just about trust, some of the services I’m exposing deal with moving files and I’m mostly interested in higher speeds associated with local transfers as well as not using up my internet data cap.
ramielrowe@lemmy.world 6 months ago
Here’s a drawing of what I think might be happening to your private traffic: traffic diagram
i_am_not_a_robot@discuss.tchncs.de 6 months ago
That sounds like Cloudflare is giving you certificates intended only to be used for talking to Cloudflare.
You might be able to do it if Cloudflare sends a different SNI. It’s probably better if you get real certificates from Let’s Encrypt and just use those.