Invalid self-signed cert from fresh install

[horsley]

log seems fine

[Migrate  ] › ℹ  info      [access_list_client] access_list Table altered
[Migrate  ] › ℹ  info      [access_list_client_fix] Migrating Up...
[Migrate  ] › ℹ  info      [access_list_client_fix] access_list Table altered
[Migrate  ] › ℹ  info      [pass_auth] Migrating Up...
[Migrate  ] › ℹ  info      [pass_auth] access_list Table altered
[Migrate  ] › ℹ  info      [redirection_scheme] Migrating Up...
[Migrate  ] › ℹ  info      [redirection_scheme] redirection_host Table altered
[Migrate  ] › ℹ  info      [redirection_status_code] Migrating Up...
[Migrate  ] › ℹ  info      [redirection_status_code] redirection_host Table altered
[Migrate  ] › ℹ  info      [stream_domain] Migrating Up...
[Migrate  ] › ℹ  info      [stream_domain] stream Table altered
[Migrate  ] › ℹ  info      [stream_domain] Migrating Up...
[Migrate  ] › ℹ  info      [stream_ssl] Migrating Up...
[Migrate  ] › ℹ  info      [stream_ssl] stream Table altered
[Migrate  ] › ℹ  info      [change_incoming_port_to_string] Migrating Up...
[Migrate  ] › ℹ  info      [change_incoming_port_to_string] stream Table altered
[Migrate  ] › ℹ  info      [regenerate_default_host] Migrating Up...
[Migrate  ] › ℹ  info      [change_forwarding_port_to_string] Migrating Up...
[Migrate  ] › ℹ  info      [change_forwarding_port_to_string] stream Table altered
[Migrate  ] › ℹ  info      [allow_empty_forwarding_port] Migrating Up...
[Migrate  ] › ℹ  info      [allow_empty_forwarding_port] proxy Table altered
[Setup    ] › ℹ  info      Creating a new user: admin@example.org with password: xxxxxxxx
[Setup    ] › ℹ  info      Initial admin setup completed
[Setup    ] › ℹ  info      Default settings added
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[SSL      ] › ℹ  info      Certbot Renewal Timer initialized
[IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ℹ  info      Backend PID 230 listening on port 48681
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[Certbot  ] › ▶  start     Installing tencentcloud...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-tencentcloud
[Certbot  ] › ☒  complete  Installed tencentcloud
[SSL      ] › ℹ  info      Requesting Certbot certificates via Tencent Cloud for Cert #1: xxxx.com
[Global   ] › ⬤  debug     CMD: certbot --logs-dir /tmp/certbot-log --work-dir /tmp/certbot-work --config-dir /data/tls/certbot --config /etc/certbot.ini --agree-tos --non-interactive --no-eff-email certonly --cert-name npm-1 --domains xxxx.com --server https://acme-v02.api.letsencrypt.org/directory --authenticator dns-tencentcloud --dns-tencentcloud-credentials /tmp/certbot-credentials/credentials-1
[SSL      ] › ℹ  info      Requesting a certificate for xxxx.com
Waiting 10 seconds for DNS changes to propagate
Successfully received certificate.
Certificate is saved at: /data/tls/certbot/live/npm-1/fullchain.pem
Key is saved at:         /data/tls/certbot/live/npm-1/privkey.pem
This certificate expires on 2025-08-29.
These files will be updated when the certificate renews.
NEXT STEPS:
- The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Saving debug log to /tmp/certbot-log/letsencrypt.log
[Global   ] › ⬤  debug     CMD: openssl x509 -in /data/tls/certbot/live/npm-1/fullchain.pem -subject -noout
[Global   ] › ⬤  debug     CMD: openssl x509 -in /data/tls/certbot/live/npm-1/fullchain.pem -issuer -noout
[Global   ] › ⬤  debug     CMD: openssl x509 -in /data/tls/certbot/live/npm-1/fullchain.pem -dates -noout
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /data/nginx/proxy_host/1.conf
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[Global   ] › ⬤  debug     CMD: nginx -tq
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /data/nginx/proxy_host/1.conf
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload

[Zoey2936]

screenshots of your config, pleasse?

[Zoey2936]

I mean the host config of the webui

[horsley]

That's the first proxy site I added, I was tring to proxy port 81 for webui, bellow was the generated config

# ------------------------------------------------------------
# xxxx.com
# DO NOT EDIT THIS FILE DIRECTLY, CHANGES WILL BE LOST WHEN UPDATING!
# ------------------------------------------------------------


server {
    set $forward_scheme "http";
    set $server "127.0.0.1";
    set $port "81";
    set $forward_path "";


    listen 0.0.0.0:80;
    listen [::]:80;


    listen 0.0.0.0:443 ssl;
    listen [::]:443 ssl;


    server_name xxxx.com;


    # Certbot TLS
    ssl_certificate /data/tls/certbot/live/npm-1/fullchain.pem;
    ssl_certificate_key /data/tls/certbot/live/npm-1/privkey.pem;


    # Force HTTPS
    include conf.d/include/force-https.conf;


    include conf.d/include/always.conf;


    location / {

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;


        include conf.d/include/proxy-headers.conf;
        proxy_pass http://127.0.0.1:81$request_uri;

    }


    # custom locations
    # Custom
    include /data/custom_nginx/server_proxy.conf;
}

[horsley]

It's seems that proxy port 81 not working as upstream npm

curl -vv https://xxxx.com         
* Host xxxx.com:443 was resolved.
* IPv6: (none)
* IPv4: 1.1.1.1
*   Trying 1.1.1.1:443...
* Connected to xxxx.com (1.1.1.1) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=xxxx.com
*  start date: May 31 08:37:44 2025 GMT
*  expire date: Aug 29 08:37:43 2025 GMT
*  subjectAltName: host "xxxx.com" matched cert's "xxxx.com"
*  issuer: C=US; O=Let's Encrypt; CN=E5
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://xxxx.com/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: xxxx.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: xxxx.com
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 301 
< date: Sat, 31 May 2025 13:53:05 GMT
< content-type: text/html
< content-length: 134
< location: https://xxxx.com:81/
< 
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
</body>
</html>
* Connection #0 to host xxxx.com left intact

Then browser follow redirect to port 81, not matching the proxy host server_name and port, so npmplus response with dummycert without sni

[Zoey2936]

the scheme needs to be https not http

[horsley]

Thanks, it's working now. I saw a line "if you proxy NPM(plus) through NPM(plus) make sure to change the scheme from http to https". Maybe we need to annotate that proxy admin port 81 was one of the situation.