Have you set up certificates with LetsEncrypt or something similar?
Since you're running it on your own hardware and obviously have admin privileges, you could try out Certbot:
HTTPS requires signed certificates to be able to connect, that's part of the trust provided in the security. Also, HTTPS is port 443 while HTTP is port 80.
The domain name in the certificate has to match the one in the browser. Does it? You haven't said.
How does it fail exactly? Surely there is some error message.
What does your nginx config look like for ssl? It should specify a certificate and key file - that certificate subject needs to match your fully qualified domain name (fqdn). Certificate can have subject alternative names (SAN) for other names and even IP addresses.
For instance, you could have a single certificate for foo.bar with a SAN for just foo and an IP SAN for 192.168.1.30.
Certificates also need to be signed by a certificate authority (CA), and in order for your browser to visit https://foo.bar/ without a warning your browser must trust that CA.
If you did a self signed cert, this is most likely the problem you're running into.
It's important to know that your communication is still encrypted because of SSL, but since your browser doesn't trust the CA (or the subject doesn't match the FQDN) the browser will say it's not secure.
Is your firewall allowing port 443 (https) traffic?
It’s most likely that your external IP is resolving to your firewall and it’s not redirecting LAN traffic.
Either setup a redirect for LAN or setup a custom DNS entry on your router pointing to the server IP.
If you do a DNS lookup (through nslookup or many other tools) on the client you're using to connect, does it get the right IP back?
make sure ports 80 (htttp) or 443 (https) are unblocked on your server
I suggest you check out pangolin. For me it’s worth about $12/year to not have a domain pointing directly at my home network, but instead have a layer of privacy and security. Running geofilter and crowdsec is really nice. Sometimes my logs show more than one blocked connection attempt per second. Another option if you want a free service is cloudflared tunneling.
top 19 comments