SEC_ERROR_BAD_SIGNATURE when using reverse proxy

Help
1

1. The problem I’m having:

I am trying to create an HTTPS reverse proxy for my vaultwarden server.

2. Error messages and/or full log output:

An error occurred during a connection to 192.168.1.168:9999. Peer’s certificate has an invalid signature.

Error code: SEC_ERROR_BAD_SIGNATURE

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

3. Caddy version:

v2.6.2

4. How I installed and ran Caddy:

a. System environment:

I running on a Raspberry Pi 4 connected via ssh.

b. Command:

sudo caddy start

c. Service/unit/compose file:

d. My complete Caddy config:

192.168.1.168:9999 {
    reverse_proxy 192.168.1.168:9900
}

192.168.1.168 is the local IP for my raspberry pi
Vaultwarden is hosted on port 9900

5. Links to relevant resources:

2

Howdy @Cael_Brenning,

Please update to the latest version (v2.8.4 as of this comment); you’re missing about two years of updates and bugfixes.

As for the cert error - your site address is an IP address, which requires Caddy to issue self-signed certificates. Valid HTTPS certs for IP addresses are generally not possible to acquire.

That means you would need to install your Caddy server’s root CA certificate in your browser in order to trust its certificate, or you would need to accept the invalid certificate and continue anyway.

1 Like
3

I installed Caddy via apt, and there are no updates available.

Where would I find the certificate?

4

The default OS for the Raspberry Pi systems is based on Debian, and their package maintainers have not opted to include the last few years of updates. We recommend you install using a more up-to-date repository.

PKI data is stored in Caddy’s data directory: Conventions — Caddy Documentation

You will want to copy the .crt file for the PKI certificate (not the private key) and install that in your client browser / OS trust store.

1 Like
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.