Self Signed Cert Reverse Proxy

Help
1

1. Caddy version (caddy version):

v2.0.0 h1:pQSaIJGFluFvu8KDGDODV8u4/QRED/OPyIR+MWYYse8=

2. How I run Caddy:

a. System environment:

OpenWrt 19.07.0, r10860-a3ffeb413b (x64)

b. Command:

caddy run

c. Service/unit/compose file:

cat /etc/rc.local

caddy run

exit0

d. My complete Caddyfile or JSON config:

www.mydomain.cc {
reverse_proxy * 10.0.0.1:8888
}
sub1.mydomain.cc {
reverse_proxy * 10.0.0.1:8082
}
sub2.mydomain.cc {
reverse_proxy * 10.0.0.2:1880
}
sub3.mydomain.cc {
reverse_proxy * 10.0.0.2:81
}
sub4.mydomain.cc {
reverse_proxy * 10.0.0.3:8081
}
sub5.mydomain.cc {
reverse_proxy https://10.0.0.3:8443
insecure_skip_verify
}

3. The problem I’m having:

I am attempting to reverse proxy one server that only serves HTTPS with a self signed certificate. There is no option to just have the server use HTTP.

The rest of the subdomains work as they are with no other configuration required.

What are the correct directives and syntax to reverse proxy this single server? Caddy v1 was able to use the insecure_skip_verify whereas now I am no longer able to do so. I have searched for four weeks without finding a full working example or a complete syntax guide for the Caddyfile.

Basically I expect Caddy2 to be able to insecurely interact with the backend for sub5.mydomain.cc and be able to reverse proxy as if it were a simple HTTP server. (Inclusive of grabbing ACME certs for the domain.)

4. Error messages and/or full log output:

2020/05/12 15:08:24.323 INFO using adjacent Caddyfile
reload: adapting config using caddyfile: Caddyfile:18: unrecognized directive: insecure_skip_verify

5. What I already tried:

See above.

6. Links to relevant resources:

https://kbeflo.github.io/2019/05/25/OpenWrt-self-signed-certificate/

2

the directive is not

insecure_skip_verify

but

tls_insecure_skip_verify

and it is used inside a transport http directive, e.g.

sub5.mydomain.cc {
  reverse_proxy https://10.0.0.3:8443 {
    transport http {
      tls
      tls_insecure_skip_verify
    }
  }
}
1 Like
3

FYI if you specify https:// on your proxy upstream, you can omit the tls transport subdirective (but you’ll still need tls_insecure_skip_verify in your case if you can’t trust the upstream)

1 Like
4

Thank you. This is functional first try.

5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.