URL for WebGUI doesnt work....

[RobinH]

According to the browser, my URL for using WebGUI has expired on December 23, even though the certificate and CA have been updated and renewed. My URLs in the HA proxy work without problems, it is only the one for webconfiguration that does not seem to work.

What could be the problem?

If I import CA for Acme in Firefox it works, but that can't be the solution right?

[viragomann]

@robinh
The browser shows an expired certificate.

You have to assign a valid one in System > Advanced > Administration.

[RobinH]

@viragomann Yes, i know. But the one that I'm using is valid in Pfsence, but not in my browser.
Why isnt the new date detected?

[viragomann]

@robinh
Indeed.
Maybe a refresh of the website can help? Press Ctrl + F5.

Or try another browser.
You can also run an online SSL-check, for instance here: https://www.ssllabs.com/ssltest/

[RobinH]

@viragomann hmm... I ran the SSL-test and it shows the correct date for validation.
But I cant get it right in my browsers, have tried the most common ones, Chrome, Edge, Firefox..

[heper]

@robinh you did restart the webgui right ?

[RobinH]

@heper Absolutely, it has been running since 2020 with the same URL since then.
But on December 23, it just stopped working when the period expired and the new one doesn't seem to be detected.

[viragomann]

@robinh said in URL for WebGUI doesnt work....:

I ran the SSL-test and it shows the correct date for validation.
But I cant get it right in my browsers, have tried the most common ones, Chrome, Edge, Firefox..

So I assume that your browsers see another certificate than the online checker.
Is there an explanation for this? Do you access the web configurator from the internet or from inside? Do you pass the access through HAproxy?

[RobinH]

@viragomann The URL is just possible from a specifik external IP or by using VPN to the local IP.

[RobinH]

@heper I read your comment a little too quickly and read “start”….
No, I have not restarted the Web Configurator individually, does that affect the firewall's function or does it run as usual?

There are many connections that affect several others if functions disappear.

[johnpoz]

@robinh said in URL for WebGUI doesnt work....:

Web Configurator individually, does that affect the firewall's function or does it run as usual?

Restarting the webgui does not affect routing/firewall function..

[viragomann]

@robinh said in URL for WebGUI doesnt work....:

The URL is just possible from a specifik external IP or by using VPN to the local IP.

So I don't expect the SSL checker to see the same certificate as your browser.

[RobinH]

@viragomann The Web COnfiguration does not pass through HA-proxy

[heper]

@robinh said in URL for WebGUI doesnt work....:

@heper I read your comment a little too quickly and read “start”….
No, I have not restarted the Web Configurator individually, does that affect the firewall's function or does it run as usual?

There are many connections that affect several others if functions disappear.

i don't know. everything that has any dependency on nginx might somehow be affected if you hit the restart webgui option on the terminal console

[johnpoz]

@robinh is your acme client set to restart the webgui?

I don't use acme for my webgui, I just use a signed cert from my own CA for that.. But yeah you kind of need to restart the gui when you change/update the cert.

[RobinH]

@johnpoz When I create a new certificate in Acme it does a restart like this /etc/rc.restart_webgui

[johnpoz]

@robinh what url are you using? I just hit your IP your using talking to the forum with on 443, and that is not an acme cert that gets presented.

Are you using some other port for your webgui other than 443, you say you tested with ssl testing and presented the correct cert?

[RobinH]

@johnpoz URL I'm using is: https://fw-01.zafe.se:1443

[johnpoz]

@robinh said in URL for WebGUI doesnt work....:

I ran the SSL-test and it shows the correct date for validation.

Not sure how that is possible from the fqdn and port you gave me - you can not do test from ssl testing on custom ports.. Oh on 443 it does present current acme cert.

I resolve that fqdn to a different IP that your talking to the forum on, etc.

But trying to access gives 503 error, something up with the haproxy seeings?

[RobinH]

@johnpoz No, I just ran it without the port. But I get the same date as the one I have in Pfsence?