search

net4people / bbs

Forum for discussing Internet censorship circumvention
3.21k stars 75 forks source link

unknown_certificate TLS alert in x-ui logs #177

Closed RealTengo closed 1 year ago

RealTengo commented 1 year ago

it has been 2 days that ssl certs dont work anymore for me, after setting it on x-ui panel it just breaks everything and i cant access the panel and it just shows me these errors : image image

pirooz-gthb commented 1 year ago

I'm not familiar with x-ui panel but by which certificate authority (CA) was the certificate issued? Let's Encrypt?

RealTengo commented 1 year ago

I'm not familiar with x-ui panel but by which certificate authority (CA) was the certificate issued? Let's Encrypt?

yes, Let's Encrypt

wkrp commented 1 year ago

@RealTengo, to me this looks like a configuration or setup problem. If so, it is off topic for this forum. It doesn't look like TLS MITM to me (which would be on topic), because the logs show a TLS server receiving a certificate_unknown alert from a client—MITM would likely result in a certificate error at the client, but not at the server.

You haven't shown the client-side TLS error. That error will be the quickest way to discover what's going wrong. If you open the page in a browser and click "Advanced" at the certificate error page, it will show an error code. For example, see https://expired.badssl.com/ and its error code SEC_ERROR_EXPIRED_CERTIFICATE (Firefox) or NET::ERR_CERT_DATE_INVALID (Chrome). If the problem is something simple like an expiration date or a missing intermediate certificate, please troubleshoot it on your own. If you think it is a bug in x-ui, better open a bug report with the developer.

RealTengo commented 1 year ago

@RealTengo, to me this looks like a configuration or setup problem. If so, it is off topic for this forum. It doesn't look like TLS MITM to me (which would be on topic), because the logs show a TLS server receiving a certificate_unknown alert from a client—MITM would likely result in a certificate error at the client, but not at the server.

You haven't shown the client-side TLS error. That error will be the quickest way to discover what's going wrong. If you open the page in a browser and click "Advanced" at the certificate error page, it will show an error code. For example, see https://expired.badssl.com/ and its error code SEC_ERROR_EXPIRED_CERTIFICATE (Firefox) or NET::ERR_CERT_DATE_INVALID (Chrome). If the problem is something simple like an expiration date or a missing intermediate certificate, please troubleshoot it on your own. If you think it is a bug in x-ui, better open a bug report with the developer.

image

after setting ssl cert/key in x-ui panel it happenes and i cant even open panel with ip address

seakfind commented 1 year ago

If you're using Cloudflare, also check your Cloudflare DNS and SSL/TLS settings.

wkrp commented 1 year ago

It seems pretty clear to me that the error messages are caused by some kind of configuration problem, not by censor activity, so I will close the discussion here.