SOLVED Oracle Incredible PBX no https GUI access

[dallas]

# openssl s_client <mysvrIP>:https < /dev/null
3069448256:error:0200206F:system library:connect:Connection refused:../crypto/bio/b_sock2.c:110:
3069448256:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111:
connect:errno=111

Mine too.

 

[dicko]

Is your server listening on https or just http?

 

[dallas]

Is your server listening on https or just http?

Just http.

 

[dicko]

Then don't expect a certificate to be served. This method is to serve web content over https but only to properly certified domain names, and further to not leak such domain names to connections to your ip address . The backends are un protected web or tcp servers, the reverse proxy handles all your certificates

https://ucp.domain.com is customer use public facing content.

https://some.ridiculousname.com is the management gui,

other random domains used for other uses like TLS signalling or https provisioning using cheap unlikely to guess namespace.

 

[qtlnx]

Current browser won't respect self signed certification so won't render the content without you jumping through hoops

No problems at all a) add browser exception and/or b) configure letsencrypt. I am currently using a).

 

[dicko]

I would consider that as Problematic, my clients generally can't or won't install site exceptions or VPN's, little trust in me if they can't use there phones and 'control panels' anywhere they go.
Neither would I trust a system can leak info so for me

a) is the hoop to which I refer, For b) I use acme.sh

GitHub - acmesh-official/acme.sh: A pure Unix shell script ACME client for SSL / TLS certificate automation

A pure Unix shell script ACME client for SSL / TLS certificate automation - acmesh-official/acme.sh

github.com

which offers a choice of Free SSL certs by default zeroSSL but LE if you insist, supports over 100 name services for hands off site sucure updating using DNS-01 not HTTP-01 and has a deployment script for HAProxy and many other 'secure' services and devices.

 

[Patrick68]

the "a2ensite default-ssl" did the trick for me. Thanks