I hope this is the right place for this.

So, here is the thing: my lemmy instance is accessible in the browser via its domain, everything is fine, but no other communities are shown. When I test federation with “curl -H “Accept: application/activity+json” https://my-instance.com/u/some-local-user” I get a SSL certificate error.

So I figured that it has something to do with my reverse proxy and modified the nginx.conf like described in the documentation.

But the error persists.

This is my nginx.config in /etc/nginx/sites-enables/<my-domain>:

" limit_req_zone $binary_remote_addr zone={{ my_domain }}_ratelimit:10m rate=1r/s;

server { listen 80; listen [::]:80; server_name {{ my_domain }}; # Hide nginx version server_tokens off; location / { return 301 https://$host$request_uri; } }

server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ my_domain }};

# Replace these lines with your own certificate and key paths
ssl_certificate /etc/ssl/certs/{{ my_certs }};
ssl_certificate_key /etc/ssl/certs/{{ my_keys }};

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers {{ cipher_encrypt }};
ssl_session_timeout  10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets on;
ssl_stapling on;
ssl_stapling_verify on;

# Hide nginx version
server_tokens off;

# Upload limit, relevant for pictrs
client_max_body_size 20M;

# Enable compression for JS/CSS/HTML bundle, for improved client load times.
gzip on;
gzip_types text/css application/javascript image/svg+xml;
gzip_vary on;

# Various content security headers
add_header Referrer-Policy "same-origin";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";
add_header X-XSS-Protection "1; mode=block";

#location / {
#  proxy_pass http://0.0.0.0:1236;
#  proxy_http_version 1.1;
#  proxy_set_header Upgrade $http_upgrade;
#  proxy_set_header Connection "upgrade";
#  proxy_set_header X-Real-IP $remote_addr;
#  proxy_set_header Host $host;
#  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#}


location / {
  set $proxy_pass "http://0.0.0.0:1236";
  if ($http_accept = "application/activity+json") {
      set $proxy_pass "http://0.0.0.0:8536";
  }
  if ($http_accept = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"") {
      set $proxy_pass "http://0.0.0.0:8536";
  }
  proxy_pass $proxy_pass;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

}

access_log /var/log/nginx/access.log combined;

"(end of file)

Maybe, someone has an idea how to solve this. I’m really at the end of my wits here :(

  • hendrik@lemmy.ml
    link
    fedilink
    English
    arrow-up
    4
    ·
    9 months ago

    Where did you get your certificates from and what’s the exact error message? Maybe you’re using self-signed certificates. Those don’t get accepted by anyone else. Your path doesn’t look like the default letsencrypt/acme path…

    • blue_berry@feddit.deOP
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      9 months ago

      Ok, yeah, I’m using a certiciate of my domain provider. Maybe that’s the problem … thanks! I will try to do it with letsencrypt/acme

      • hendrik@lemmy.ml
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        9 months ago

        That would explain it. I mean if your provider provides you with a proper certificate, you can also use that. But often times it’s just a temporary self-signed placeholder that’s only good for development and not valid.

      • SirMaple_@lemmy.sirmaple.ca
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        9 months ago

        Nah don’t use those. Get your own direct from Let’s Encrypt. Less hoops to go through when its time to renew. Acme with a crontab entry takes care of renewals automatically. Don’t forget to add to the crontab line to restart nginx right after the renewal so that the new certs are used.

        Edit: spelling

  • damium@programming.dev
    link
    fedilink
    English
    arrow-up
    2
    ·
    9 months ago

    Likely you needed to include the intermediate cert chain. Let’s encrypt sets that up automatically so it’s quite a bit easier to get right.

  • redcalcium@lemmy.institute
    link
    fedilink
    English
    arrow-up
    1
    ·
    9 months ago

    Does the SSL error also occur when you access https://yourlemmyinstance.com from curl without the extra activity+json header?

    • blue_berry@feddit.deOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      9 months ago

      Yes, also occures without the header. But I think I know the problem now: I tried to use the certificate of my host provider, which seems not to work for federation

  • key@lemmy.keychat.org
    link
    fedilink
    English
    arrow-up
    1
    ·
    9 months ago

    You can try using openssl s_client -connect domain:443 to help debug what the issue is. Without your domain it’s hard to guess what specifically is causing a TLS issue.

    Where did you get your certs? Do they match exactly the domain you’re using? Are they expired or self signed? Are your details in the double curly brackets all correct?

    You can try to use ssllabs, check cipher compatibility with browsers and such… though I think that requires things are working to a certain level first.

  • Decronym@lemmy.decronym.xyzB
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    9 months ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    HTTP Hypertext Transfer Protocol, the Web
    SSL Secure Sockets Layer, for transparent encryption
    TLS Transport Layer Security, supersedes SSL
    nginx Popular HTTP server

    3 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.

    [Thread #483 for this sub, first seen 4th Feb 2024, 21:25] [FAQ] [Full list] [Contact] [Source code]