Certificate error

Platform Certificate
1

Hi,

i am not sure if my problem is related to yesterday’s problem of people not being able to connect to syncloud.it. Anyway since yesterday I don’t get secure access to my syncloud anymore.

Yesterday, I checked my certificate in the settings section and it had a red cross where it says real. Today there is a green checkmark. But when I check the logs I get this response:

May 03 19:30:47 odroid-xu3and4 platform.backend[545]: info cert/generator.go:86 not regenerating real certificate {“category”: “certificate”}

May 03 19:30:47 odroid-xu3and4 platform.backend[545]: info cert/generator.go:83 certificate info {“category”: “certificate”, “valid days”: 89, “real”: true}

May 03 19:25:38 odroid-xu3and4 platform.backend[545]: info cert/generator.go:86 not regenerating real certificate {“category”: “certificate”}

May 03 19:25:38 odroid-xu3and4 platform.backend[545]: info cert/generator.go:83 certificate info {“category”: “certificate”, “valid days”: 89, “real”: true}

Restarting the system has not helped. My syndloud is in the syncloud domain and is private.

Thanks

2

Can you send you domain name to support so I can check the certificate?

3

Ah you said it is private, no external access?
Are you saying it is green today but something it still not right?

4

I will send you the domain immediately. It is private, no external access. Both check marks are green today, but when I try to connect (from within my network, obviously) I will get a certificate error. Similarly, the Nextcloud app on my computer cannot connect to the server. The only way to connect is to use the internal IP address, not the domain name.

Thanks

5

Looks like you only have IPv6 DNS (and not IPv4):

  1. IPv6 (Type AAAA) DNS name
  2. IPv4 (Type A) DNS name, which is public because device cannot get its own IPv4.

You can see DNS using web dig tool: https://www.digwebinterface.com

Your device cannot get it’s IPv4 local address probably because IPv4 is not enabled on router (any more?).

You can check this by running this command on the device:

snap run platform.cli ipv4 private

Or looking at Settings - Network page.

So if you open the browser on IPv6 network it should work but if you try browser on IPv4 network it should not work as it will try to access your public IPv4 (which will need 443 port forward which you do not want as it will be publicly accessible)

6

Thank you for your advice. I still have not found out, whether that’s the problem. Indeed I recently updated my router to a new os-version and that may have changed something. But according to my router IPv4 and IPv6 are enabled (IPv4 through a DSlite tunnel).

I seem to have forgotten my root password for my syncloud machine, so I can’t ssh it. When I go to the settings - network page it shows my local IPv4 and public IPv6.

However, I will get a certificate error no matter how I connect to the syncloud decive, be it domain name, iPv4 or ipV6 address. I can override that for IPv4 and 6, but not for the domain name (because of something apparently called HTTP Strict Transport Security (HSTS)).

7

Root password is the same as you main user password, can you try it?

8

thank you, that worked. It returned the correct local IPv4 address.

9

Ok, could you save Settings - Access page and send logs to support?
Try:

  1. ipv4 enabled, non public
  2. Ipv6 disabled
10

Just did that. I got an error both times about ports not being reachable.

11

I think there is an issue that does not allow you to save even when ipv4 is in private mode, I will fix that asap (Access save requires external port even to private ipv4 · Issue #683 · syncloud/platform · GitHub)

Could you open port on your router save with only ipv4 private mode and then remove port mapping?

Or you could wait a day or so untill I push the update to fix the save.

12

I have just pushed the fix, could you update system from Settings - Updates and try to save Access, this time you do not need to open any port on the router, ipv4 non public should just save.

13

Thank you very much! It’s working now.

I must say, your support has always been swift and helpful.

I’m off to your donations page now…

1 Like