SSL Cipher error

[checkerbomb]

I've installed a custom SSL certificate, and played with all the settings, but currently receiving an SSL error. I have ports 80/443 forwarded through the firewall to the nginx-proxy-host container. I've tried toggling things on/off in the Proxy Host settings with no change. Here are the basic settings I'm trying to use:

Here is the error I receive.

Chrome:

Firefox:

[jc21]

Can you use an online SSL checker to see what they say about the setup?

• https://www.sslshopper.com/ssl-checker.html
• https://www.ssllabs.com/ssltest/
• https://www.digicert.com/help/

[checkerbomb]

Thanks for the reply. Based on these tests, it seems to me that the SSL cert is not being presented by nginx. Here are the results from the first two links. I should also note that I am using this same cert without issue on pfSense via haproxy, which I am attempting to replace with nginx-proxy-manager. I have also double checked that firewall and NAT rules are setup correctly, and reuploaded the cert and reconfigured the proxy host as well.

[jc21]

Ok that's super weird. Can you find the generated nginx config file for this host, it will be in your data/nginx/proxy_host folder, paste the contents here without your ___domain name for privacy

[checkerbomb]

Sure thing. The formatting of the file was getting severely screwed up by Markdown, so I've attached it instead.

proxy-conf.txt

[jc21]

Ok so you can't use my.___domain.com/portainer as the hostname, because it contains a path. When you ssl check my.___domain.com/portainer it's actually checking my.___domain.com and that doesn't (presumably) has configuration - and won't have ssl configured.

It's only currently possible to create portainer.___domain.com host and apply a custom wildcard cert for domain.com to that proxy host.

Refer to #74 for possible future support of sub-folder forwarding.

[checkerbomb]

OK, thanks for the feedback. I will wait until this has been implemented, as setting up a subdomain for each and every application I need to forward (currently 12 but steadily increasing) would be cumbersome and also defeat the purpose of the custom SSL cert I have previously purchased for this specific subdomain.

I will say that I personally believe reverse proxying based on path is a critical feature and one that many will make use of. Nginx already supports it natively. https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/

Thanks! :)