Self hosted - Problem connecting server - Android #190

@kspearrin commented on GitHub (Jan 29, 2018):

Can you send your domain to support@bitwarden.com so we can look?

@kspearrin commented on GitHub (Jan 29, 2018): Can you send your domain to support@bitwarden.com so we can look?

GiteaMirror commented

@kspearrin commented on GitHub (Jan 29, 2018):

Your cert has trust issues. This is why it fails. See https://www.digicert.com/help/

@kspearrin commented on GitHub (Jan 29, 2018): Your cert has trust issues. This is why it fails. See https://www.digicert.com/help/

GiteaMirror commented

@Scifire commented on GitHub (Jan 30, 2018):

@kspearrin thanks, i figured out how to fix this.
could it be that in the how to is something wrong? I´ve done this step by step.
I have the certificate and also the ca.crt in the folder but nginx won´t use the ca.crt. I have to create a bundle.crt which includes certificate.crt und ca.crt, rename this and now it works.

@Scifire commented on GitHub (Jan 30, 2018): @kspearrin thanks, i figured out how to fix this. could it be that in the how to is something wrong? I´ve done [this](https://help.bitwarden.com/article/install-on-premise/) step by step. I have the certificate and also the ca.crt in the folder but nginx won´t use the ca.crt. I have to create a bundle.crt which includes certificate.crt und ca.crt, rename this and now it works.

GiteaMirror commented

@kspearrin commented on GitHub (Jan 30, 2018):

What type of cert are you using? Our installer only generates LE certs. Other than that you have to provide your own proper cert. Which configuration did you choose during set up? This determines how your nginx config file gets generated.

@kspearrin commented on GitHub (Jan 30, 2018): What type of cert are you using? Our installer only generates LE certs. Other than that you have to provide your own proper cert. Which configuration did you choose during set up? This determines how your nginx config file gets generated.

GiteaMirror commented

@Scifire commented on GitHub (Jan 30, 2018):

We use a wildcard cert from digicert. Most CAs give you a separate cert file and ca cert file. Letsencrypt give you also a cert.csr but also a fullchain.pem which is a bundle of ca cert and cert.
So i would recommend you to add this step to the help page:
Create a bundle of Cert and CA cert if it´s not.
cat certificate.crt ca.crt >>bundle.crt

@Scifire commented on GitHub (Jan 30, 2018): We use a wildcard cert from digicert. Most CAs give you a separate cert file and ca cert file. Letsencrypt give you also a cert.csr but also a fullchain.pem which is a bundle of ca cert and cert. So i would recommend you to add this step to the help page: Create a bundle of Cert and CA cert if it´s not. `cat certificate.crt ca.crt >>bundle.crt`

GiteaMirror commented

@kspearrin commented on GitHub (Jan 30, 2018):

Which cert option did you choose during install? This is the login used:

        var sslPath = LetsEncrypt ? $"/etc/letsencrypt/live/{Domain}" :
            SelfSignedSsl ? $"/etc/ssl/self/{Domain}" : $"/etc/ssl/{Domain}";
        var certFile = LetsEncrypt ? "fullchain.pem" : "certificate.crt";
        var keyFile = LetsEncrypt ? "privkey.pem" : "private.key";
        var caFile = LetsEncrypt ? "fullchain.pem" : "ca.crt";

@kspearrin commented on GitHub (Jan 30, 2018): Which cert option did you choose during install? This is the login used: var sslPath = LetsEncrypt ? $"/etc/letsencrypt/live/{Domain}" : SelfSignedSsl ? $"/etc/ssl/self/{Domain}" : $"/etc/ssl/{Domain}"; var certFile = LetsEncrypt ? "fullchain.pem" : "certificate.crt"; var keyFile = LetsEncrypt ? "privkey.pem" : "private.key"; var caFile = LetsEncrypt ? "fullchain.pem" : "ca.crt";

GiteaMirror commented

@Scifire commented on GitHub (Jan 30, 2018):

During install i used "Use existing cert"
Problem is that nginx can´t use a cert File and a different ca file (as far as i know)

@Scifire commented on GitHub (Jan 30, 2018): During install i used "Use existing cert" Problem is that nginx can´t use a cert File and a different ca file (as far as i know)

GiteaMirror commented

@kspearrin commented on GitHub (Jan 30, 2018):

I am still a bit confused as to what needs to be changed though?

@kspearrin commented on GitHub (Jan 30, 2018): I am still a bit confused as to what needs to be changed though?

GiteaMirror commented

@Scifire commented on GitHub (Jan 30, 2018):

The Install on Premise instruction is not complete.
If you use a single file certificate and a single file CA certificate (certificate.crt & ca.crt) it won´t work. nginx can handle this only in a bundle.
So i need to create this bundle manual as i wrote above or you add some magic in docker which do this for me.

@Scifire commented on GitHub (Jan 30, 2018): The [Install on Premise](https://help.bitwarden.com/article/install-on-premise/) instruction is not complete. If you use a single file certificate and a single file CA certificate (certificate.crt & ca.crt) it won´t work. nginx can handle this only in a bundle. So i need to create this bundle manual as i wrote above or you add some magic in docker which do this for me.

GiteaMirror commented

@kspearrin commented on GitHub (Jan 30, 2018):

So after you create the bundle.crt what do you do with it? the nginx config is not looking for a file called bundle.crt

@kspearrin commented on GitHub (Jan 30, 2018): So after you create the bundle.crt what do you do with it? the nginx config is not looking for a file called bundle.crt

GiteaMirror commented

@Scifire commented on GitHub (Jan 30, 2018):

rename it to certificate.crt that nginx use it ;-)

@Scifire commented on GitHub (Jan 30, 2018): rename it to certificate.crt that nginx use it ;-)

GiteaMirror commented

@kspearrin commented on GitHub (Jan 30, 2018):

Sorry I am not an expert on SSL certs, so to be clear:

You received a certificate.crt, and ca.crt from your SSL provider.
You run cat certificate.crt ca.crt >>bundle.crt you create a new bundle.crt.
In bitwarden's ssl folder for your domain you replace original certificate.crt with bundle.crt (renamed to certificate.crt so it can still be read)?

@kspearrin commented on GitHub (Jan 30, 2018): Sorry I am not an expert on SSL certs, so to be clear: 1. You received a `certificate.crt`, and `ca.crt` from your SSL provider. 2. You run `cat certificate.crt ca.crt >>bundle.crt` you create a new `bundle.crt`. 3. In bitwarden's ssl folder for your domain you replace original `certificate.crt` with `bundle.crt` (renamed to `certificate.crt` so it can still be read)?

GiteaMirror commented