this post was submitted on 28 Sep 2024

11 points (100.0% liked)

Selfhosted

39353 readers

419 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

Randomly getting ECH errors on self-hosted services. (lemmy.ca)

submitted 3 hours ago by Darkassassin07@lemmy.ca to c/selfhosted@lemmy.world

12 comments fedilink hide all child comments

In the last couple of weeks, I've started getting this error ~1/5 times when I try to open one of my own locally hosted services.

I've never used ECH, and have always explicitly restricted nginx to TLS1.2 which doesn't support it. Why am I suddenly getting this, why is it randomly erroring, then working just fine again 2min later, and how can I prevent it altogether? Is anyone else experiencing this?

I'm primarily noticing it with Ombi. I'm also mainly using Chrome Android for this. But, checking just now; DuckDuckGo loads the page just fine everytime, and Firefox is flat out refusing to load it at all.

Firefox refuses to show the cert it claims is invalid, and 'accept and continue' just re-loads this error page. Chrome will show the cert; and it's the correct, valid cert from LE.

There's 20+ services going through the same nginx proxy, all using the same wildcard cert and identical ssl configurations; but Ombi is the only one suddenly giving me this issue regularly.

The vast majority of my services are accessed via lan/vpn; I don't need or want ECH, though I'd like to keep a basic https setup at least.

top 12 comments

sorted by: hot top controversial new old

[–] Moonrise2473@feddit.it 2 points 1 hour ago (1 children)

I had a similar problem when using nginx proxy manager. In the end I just gave up and directly used cloudflare tunnels+cloudflare ssl

[–] Darkassassin07@lemmy.ca 1 points 1 hour ago

I think I've found the problem:

It seems my issue is pihole being unable to block/modify dns requests for HTTPS records, which don't match the LAN IPs pihole handed out in A/AAAA records.

I've disabled cloudflare proxying so they don't have HTTPS records to serve, but I'll have to replace pihole with a better lan DNS solution if I want to turn that back on.

[–] sk@hub.utsukta.org 2 points 2 hours ago (1 children)

this issue is an ongoing discussin over at NPM too, very mysterious

https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3982

[–] Darkassassin07@lemmy.ca 1 points 2 hours ago* (last edited 1 hour ago)

Thanks. That seems to be a similar, but slightly different error. I think the below may apply though.

I believe I've tracked down more of my issue, but fixing it is going to be a hassle:

When cloudflare proxying is enabled, there are 3 DNS records involved; A record with cloudflares ipv4, AAAA record with cloudflares IPV6, and the key to this puzzle: an HTTPS record with cloudflares ech/https config.

With pihole I can set DNS records for A/AAAA, but I have no way of blocking/setting the HTTPS record so it gets through from cloudflare.

The LAN A/AAAA records don't match the HTTPS record from cloudflare, so browsers freak out.

Once I disabled cloudflares proxying, I no longer get HTTPS records returned and all works as intended.

I'll either have to keep cloudflare proxying disabled, or switch pihole out for a more comprehensive DNS solution so I can set/block HTTPS records :(

Thank you @bobslaede@feddit.dk for pointing me in the right direction.

[–] bobslaede@feddit.dk 5 points 3 hours ago (1 children)

Any chance you are both accessing your services locally with a local DNS, and publicly with something like Cloudflare?

[–] Darkassassin07@lemmy.ca 1 points 3 hours ago* (last edited 3 hours ago) (2 children)

I do have external acces to Ombi via cloudflare; but the device I'm seeing this problem on is permanently connected to a VPN hosted from the same server machine as ombi/nginx with 'block all connections without VPN' enabled. And this testing has been done from within the same LAN.

It should never see/reach cloudflare for this service.

/edit; I've also disabled 'use secure DNS' in chrome. I host a local DNS within that lan/vpn network.

[–] solrize@lemmy.world 2 points 3 hours ago (1 children)

Can you verify with wireshark that the traffic is only going through your lan? I'm not hip enough for nginx but I used to have to run apache under gdb all the time to trace random errors from the server. That would be next, if the traffic is really local.

[–] Darkassassin07@lemmy.ca 1 points 2 hours ago

I'll look into that next if what I've done doesn't work. (see other comments)

[–] bobslaede@feddit.dk 2 points 3 hours ago* (last edited 3 hours ago) (2 children)

Try with nslookup and see if you're resolving the domain to both your local ipv4 address, and the Cloudflare ipv6 at the same time. I am using pihole for my local DNS, and it would give me both my local address, and also the Cloudflare ipv6 address.

Edit
My pihole will ask upstream even if the domain was listed locally. It doesn't ask Upstream for cname.

[–] Darkassassin07@lemmy.ca 2 points 2 hours ago

Crap, looks like that's exactly what it is.

Now how to fix that...

[–] Darkassassin07@lemmy.ca 1 points 2 hours ago (1 children)

Added an AAAA record to pihole:

ombi.mydomain.example 0000:0000::0000:0000

Now nslookup returns the correct ipv4 address, and '::' as the ipv6.

We'll see if that works.

[–] Darkassassin07@lemmy.ca 1 points 2 hours ago* (last edited 2 hours ago)

That unfortunately did not work. I am only getting the ipv4 address now, but I still get the same ECH error in chrome 1/5 tries.

Firefox now changed errors from 'invalid certificate' to 'connection is insecure but this site has HSTS' (true). Still wont show the cert or provide any further info. (forgot to grab a screenshot before the below 'solution')

I'm really annoyed at this point and have just disabled cloudflare proxying for this service. That seems to have sorted it for all browsers. I may look further later, I may just say fuck it and leave it like this. Gotta walk away for a bit.