Android phone not opening webpage for remote connection (no secure connection)

[pddpauw]

Hi birders,
question: i have a set-up where my BirdNet Pi's are accessible outside my LAN (DNS server and portforwarding to the right Pi), but lately, I got the question from an Android phone user that he can't access the webpage.
He gets a notification saying "this site can’t provide a secure connection".

I googled around and this could be solved with clearing browser cache at client side, but is not really user-friendly.

I presume this could be solved by forwarding HTTPS requests to the right PI (instead of forwarding HTTP request), and somehow configure my Caddyfile to listen to https requests...?

Any of you who had a similar case, and what exactly did you do to resolve? Would above description be sufficient to resolve (I can try of course, but wanted to check first)? How would the Caddyfile need to be adapted?

thx - Pieter

[Svardsten53]

If you define a HTTPS address in the configuration the Caddyfile will be automatically updated. Of course you will also have to define port 443 in your router to point to your Pi. I have always used HTTPS for my installations and have never got that error message.

[pddpauw]

Hi, thanks for this. Your explanation seems simple, but somehow I can't get to a solution that works....

I think I make it too difficult:
I have a public DNS with non-static IP behind which I have my servers. This would require me -I guess?- to install the SSL certificates and configure the Caddyfile accordingly.
Unfort, the DNS would not allow me to verify domain ownership (http verification doesn't work, since ISP is blocking port 80, and I can not change/edit CNAME in the DNS).

Curious to understand how you worked with certificates and public DNS.

thx

[Svardsten53]

If you do HTTPS calls to Caddy in the BirdNET-Pi installation it will take care of the certificates including updates. I guess this will work if you only have one single web server behind your router. You need to define correct HTTPS address in your BirdNET-Pi configuration. I also presume port 80 not will be involved as long as you do HTTPS calls.

If you have several web servers behind your router you need to define subdomains in the DNS if you have one single domain name pointing to the same port. This can be handled by a reverse proxy in your network which will make HTTP (not HTTPS) calls to the different web servers. The proxy need to handle the certificates. I know Synology NAS servers have this feature.

As I understand it Caddy can act as a reverse proxy, but I have not tried it. You have to google the solution.

[pddpauw]

I've tried this in the BirdNET-Pi settings (adding the https url), but the only thing this does, is adding the https url in the Caddyfile.

I have the following set-up: a router which forwards port 84 to to my BirdNET-Pi.
When forwarding to port 80 (and having http in my Caddyfile), this all works wel.
When forwarding to port 443 (and having https in my Caddyfile), I get this error: ERR_SSL_PROTOCOL_ERROR

In the logging:
"http.acme_client","msg":"challenge failed","identifier":"studiomondo.myqnapcloud.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"81.246.180.136: Fetching http://studiomondo.mynapcloud.com/.well-known/acme-challenge/W3244Zc0HzfcOsiqS7PjsBoegz8bayGRNfhepN6Sh04: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/134885803/14203939863","attempt":1,"max_attempts":3}

This is linked to my ISP not allowing to use port 80, so fear a bit I won't be able to get around this...?