How to enable-https with a tailscale cert? about nextcloud-snap HOT 7 CLOSED

It may be that tailscale is only giving you the fullchain cert. Open up your .crt file. Do you see multiple "BEGIN CERTIFICATE"/"END CERTIFICATE" lines indicating that your cert is actually several certs?

from nextcloud-snap.

It may be that tailscale is only giving you the fullchain cert. Open up your .crt file. Do you see multiple "BEGIN CERTIFICATE"/"END CERTIFICATE" lines indicating that your cert is actually several certs?

Thank you so much for a quick reply. As you may guess, I am not very well versed in how all this happens. But, YES, in the cert.pem file there are 2 blocks of BEGIN and END certificate entries. So does that imply that what I have is the chain and I should simply repeat its use as the 3rd parameter like this:

sudo nextcloud.enable-https custom cert.pem key.pem cert.pem

I will attempt that and report back.

from nextcloud-snap.

Not quite, the chain doesn't generally include the final cert, but that's beside the point: yes, give that a shot. We really should support not supplying a chain file, that's deprecated in Apache nowadays anyway because it now supports chained certs, like you have.

from nextcloud-snap.

YES I think that works! I did need to duplicate the file since it complained there was no chain.pem still. Here is the simple explanation:

$ sudo cp cert.pem chain.pem
$ sudo nextcloud.enable-https custom cert.pem key.pem chain.pem 
Installing custom certificate... done
Restarting apache... done

And I can now access nextcloud from a browser this way with no complaint about not being https etc:

https://myname.ts.net/

I will link to this issue for others that have been having the same issues. Thank you for the suggestion.

from nextcloud-snap.

Closing, thanks again!

from nextcloud-snap.

Excellent. Okay, while it's true that this issue is unrelated to the other one, I'll share the same word of caution. Let's Encrypt certificates are designed to be automatically renewed. Operating under that assumption means they can make their certs valid for very short timespans: 90 days. By manually loading those certs into Nextcloud, you're signing yourself for manually loading new certs in every 90 days or so or they will expire.

from nextcloud-snap.

Excellent. Okay, while it's true that this issue is unrelated to the other one, I'll share the same word of caution. Let's Encrypt certificates are designed to be automatically renewed. Operating under that assumption means they can make their certs valid for very short timespans: 90 days. By manually loading those certs into Nextcloud, you're signing yourself for manually loading new certs in every 90 days or so or they will expire.

Yes, understood. I will have to see how much pain this is, not sure if I can whip up a simple script with cron to take care of renewal? I see tailscale referencing "caddy" which can run on the server as well to manage this, but I am a bit out of my league (I am sure you will understand more than me :-) https://tailscale.com/kb/1190/caddy-certificates

from nextcloud-snap.