cockpit +SSL

[yghr1]

Explain what happens

1.Hello, there is an SSL certificate error when logging in to the Web platform on the domestic server. I want to know whether the problem can be solved by the self-defined self-signed certificate.But you can access 127.0.0.1 locally (unencrypted yes).

Version of Cockpit

cockpit 270

Where is the problem in Cockpit?

No response

Server operating system

CentOS

Server operating system version

CentOS stream

What browsers are you using?

Chrome

System log

Jul 05 10:51:39 localhost.localdomain systemd[1]: fprintd.service: Succeeded.
Jul 05 10:52:08 localhost.localdomain geoclue[2487]: Service not used for 60 seconds. Shutting down..
Jul 05 10:52:08 localhost.localdomain systemd[1]: geoclue.service: Succeeded.
Jul 05 10:52:09 localhost.localdomain realmd[2621]: quitting realmd service after timeout
Jul 05 10:52:09 localhost.localdomain realmd[2621]: stopping service
Jul 05 10:52:09 localhost.localdomain systemd[1]: realmd.service: Succeeded.
Jul 05 10:53:03 localhost.localdomain systemd[1]: libvirtd.service: Succeeded.
Jul 05 10:53:57 localhost.localdomain sshd[2710]: Accepted password for root from 172.16.66.124 port 62786 ssh2
Jul 05 10:53:57 localhost.localdomain sshd[2710]: pam_motd(sshd:session): pam_motd: error scanning directory /run/motd.d
Jul 05 10:53:57 localhost.localdomain systemd[1]: Created slice User Slice of UID 0.
Jul 05 10:53:57 localhost.localdomain systemd[1]: Starting User runtime directory /run/user/0...
Jul 05 10:53:57 localhost.localdomain systemd-logind[1395]: New session 2 of user root.
Jul 05 10:53:57 localhost.localdomain systemd[1]: Started User runtime directory /run/user/0.
Jul 05 10:53:57 localhost.localdomain systemd[1]: Starting User Manager for UID 0...
Jul 05 10:53:57 localhost.localdomain systemd[2717]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Starting D-Bus User Message Bus Socket.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Reached target Timers.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Listening on Multimedia System.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Reached target Paths.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Listening on D-Bus User Message Bus Socket.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Reached target Sockets.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Reached target Basic System.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Reached target Default.
Jul 05 10:53:58 localhost.localdomain systemd[2717]: Startup finished in 138ms.
Jul 05 10:53:58 localhost.localdomain systemd[1]: Started User Manager for UID 0.
Jul 05 10:53:58 localhost.localdomain systemd[1]: Started Session 2 of user root.
Jul 05 10:53:58 localhost.localdomain sshd[2710]: pam_unix(sshd:session): session opened for user root by (uid=0)
Jul 05 10:53:58 localhost.localdomain dbus-daemon[2795]: [session uid=0 pid=2793] Activating service name='org.gtk.vfs.Daemon' requested by ':1.0' (uid=0 pid=2802 comm="g>
Jul 05 10:53:58 localhost.localdomain dbus-daemon[2795]: [session uid=0 pid=2793] Successfully activated service 'org.gtk.vfs.Daemon'

[garrett]

Are you using a proxy, like NGINX or Apache?

Here are two different guides for using either webserver with Cockpit in front:

• NGINX proxy: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-NGINX
• Apache as a proxy, with LetsEncrypt: https://cockpit-project.org/external/wiki/Proxying-Cockpit-over-Apache-with-LetsEncrypt

If you're not using a proxy and are using Cockpit's default certificates, then also leave a reply here to let us know that too. It should work by default.

[yghr1]

No proxy is used.But can I get a solution to the problem by providing you with logs and other data?

[garrett]

Are you trying to connect to Cockpit from the same machine or a local network? Or from outside your local network (like from the Internet)?

[garrett]

Logs would help, but knowing your setup would probably help even more.

Additionally, have you tried another browser to see if you get different results? (Chrome should definitely work; another browser, such as Firefox, could help diagnose things.)

[yghr1]

Cockpit is accessible on PC (127.0.0.1), but not on LAN(Internet)).

[garrett]

LAN or Internet? It makes a difference.

LAN is local area network. Internet is from outside your LAN, through a 3rd party ISP (Internet Service Provider).

[garrett]

It really looks like a proxy problem though.

• If your browser is running on Windows (which it looks like in the first screenshot), then it could still be a proxy problem if you're running some kind of malware or virus scanner. (Often, these are malware themselves, as they sometimes do a man-in-the-middle attack on all your connections, including SSL.)
• Also, I see your browser looks like it is in Chinese. If it's going through the Great Firewall, it could possibly be doing something odd too. It does do blocking outright and throttling... and also has rewriting proxies. https://en.wikipedia.org/wiki/Great_Firewall#Blocking_methods

Either of the above methods with rewriting can cause a TLS (security) issue when certificates don't match... and that might be what you're running into here? I don't know; I'm guessing here.

[garrett]

In addition to proxy problems, ERR_SSL_PROTOCOL_ERROR could also indicate that your date and time settings are incorrect on one of your machines.

[yghr1]

In addition to the log, please elaborate on the specific information I can provide you. I tried a variety of Google and Firefox browsers.

[garrett]

What versions are your browsers?

[yghr1]

Sorry, I am using local area network here, mislead you!

[yghr1]

I don't use any proxies here (I started with the default certificate).