"
Hi community
I have a new OPNsense up and running (3 months now, recently came from Sophos XG), with an nginx reverse proxy and three webservers running locally which can be accessed from public using https. Two servers are internally running http and one (nextcloud) is running internally with https.
Now I need to replace my wildcard certificate *.example.com with single domain certificates from let's encrypt. Wildcard letsencrypt doesn't work with my domain provider.
This works fine for both unencrypted servers, these can be reached externally using https with letsencrypt and http internally.
I have issues with my internal https connection between opnsense and nextcloud when using the newly created letsencrypt certificates.
When using the letsencryt certificates internally and externally then opnsense/nginx won't communicate with the internal nextcloud server telling me it can't verify the certificate chain.
But openssl directly from OPNsense shell works fine with status OK when verifying the connection.
Internally the certificate is also working and I can connect to nextcloud internally using https using the new letsencrypt certificate.
What is working (but not a solution as the certificate will expire in two weeks):
internet --> opnsense/nginx/letsencrypt --> nextcloud/wildcard
But not:
internet --> opnsense/nginx/letsencrypt --> nextcloud/letsencrypt
Internally it doesn't matter whether letsencrypt ot wildcard, both are fine - it's the connection between opnsense/nginx and the internal web server
I checked all root certificates and they look fine and are installed on opnsense.
What could be the problem?
I have a new OPNsense up and running (3 months now, recently came from Sophos XG), with an nginx reverse proxy and three webservers running locally which can be accessed from public using https. Two servers are internally running http and one (nextcloud) is running internally with https.
Now I need to replace my wildcard certificate *.example.com with single domain certificates from let's encrypt. Wildcard letsencrypt doesn't work with my domain provider.
This works fine for both unencrypted servers, these can be reached externally using https with letsencrypt and http internally.
I have issues with my internal https connection between opnsense and nextcloud when using the newly created letsencrypt certificates.
When using the letsencryt certificates internally and externally then opnsense/nginx won't communicate with the internal nextcloud server telling me it can't verify the certificate chain.
Quote*161 upstream SSL certificate verify error: (20:unable to get local issuer certificate) while SSL handshaking to upstream, client: xxx.xxx.xxx.xxx, server: nextcloud.example.com, request: "GET /index.php/204 HTTP/2.0", upstream: "https://172.16.10.10:443/index.php/204", host: "nextcloud.example.com"
But openssl directly from OPNsense shell works fine with status OK when verifying the connection.
Code Select
openssl s_client -connect 172.16.10.10:443 -servername nextcloud.example.com -showcerts < /dev/nullShows Code Select
Verify return code: 0 (ok)Internally the certificate is also working and I can connect to nextcloud internally using https using the new letsencrypt certificate.
What is working (but not a solution as the certificate will expire in two weeks):
internet --> opnsense/nginx/letsencrypt --> nextcloud/wildcard
But not:
internet --> opnsense/nginx/letsencrypt --> nextcloud/letsencrypt
Internally it doesn't matter whether letsencrypt ot wildcard, both are fine - it's the connection between opnsense/nginx and the internal web server
I checked all root certificates and they look fine and are installed on opnsense.
What could be the problem?
