SSL Certs behind Nginx Proxy Manager (Separate Servers)

[Xisdibik]

Hello,

I have Meshcentral on a VM (debian) on my proxmox server that when originally setup behind nginx but not setup to hand off SSL to it, allows access to the server page but agents won't connect. I then followed the steps in the userguide to get nginx and the server speaking to each other and either ended with 502 Gateway error (before) or ERR_SSL_UNRECOGNIZED_NAME_ALERT (current). I have looked through a lot of similar issues and tried some of their fixes but none of them seem to help or are not exactly what I am facing.

Am I supposed to be downloading the cert from Nginx and placing it somewhere (replace the webserver/agent crt files?) or something like that?

The only thing I didn't do with the nginx instructions (guide + video) was do the 4430 and 800 ports because they are not on the same machine.

my config.json looks like this (mesh.mydomain.com is not whats actually there it is the real domain name)

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
    "cert": "mesh.mydomain.com",
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80,
    "agentPong": 300,
    "TlsOffload": "192.168.85.30",
    "trustedProxy": "192.168.85.30"
  },
  "domains": {
    "": {
      "_title": "MyServer",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true,
      "certUrl": "https://192.168.85.30/"
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "[email protected]",
    "names": "myserver.mydomain.com",
    "skipChallengeVerification": true,
    "production": false
  }
}

Anyone have any idea where I am going wrong?

[si458]

so from the looks your config is all correct apart from the certurl should be the DNS name you use to access meshcentral,
and make sure it can be resolved from within the meshcentral VM! curl -v https://mymeshserver.com

then you should point your nginx to http://MESHCENTRALVMIP:443, make sure its HTTP and NOT HTTPS!

[si458]

Will try the stuff you just mentioned but as for cloudflare. Yes I am using them for the Let's Encrypt SSL cert. I don't think I am using its tunnel service though. and the domain is not proxied through them (DNS only) for the A record on my domain.

Right that's OK! I wasn't sure if u was using there tunnels product to avoid opening ur firewall!

But if ur firewalls open and u are port forwarding to ur reverse proxy then that's OK too!

[Xisdibik]

Yep, I am just port forwarding the ports for nginx on my firewall.

[si458]

I will have to test tomorrow if I get chance (off bed)
Ive never used nginx proxy manager before so u might need something specific setting somewhere!

[Xisdibik]

That was my thought and I searched high and low for someone using proxy manager to give me a hint but was unsuccessful. Have a good night (its just after noon here), I'll check back here later/tomorrow to see if you had any post sleep miracles.

[Xisdibik]

I was able to get it to bring up mesh central with the settings you provided (with minor adjustment, I will have to look through what I did since its been a few days of busy work. However the meshagents still don't show up when connecting (which was the original issue). So something I think does need to go in the nginx advanced tab (or location) to tell it to pass the SSL info to mesh central so the agents SSL certs match things.

Hopefully I'll have some free time soon to take another stab at it.