struggling with ssl

[bmackenty]

Hello Grapenut,

I've gotten the basics of mush-portal setup, but my site is on https, so I understand I need to use / setup SSL for my mush. Sadly, after a few different permutations I am still unable to get this working. I'm hoping you might be able to help me. My goal is to get mush-portal working. My hunch is that ssl isn't setup correctly. I have followed the instructions on the Pennmush SSL README.

If you could help me in anyway, I would be grateful. I'm resurrecting this game after many dormant years, and this portal seems perfect to use for 2019 :-)

Some information which might be helpful:

1. I'm using PennMUSH version 1.8.7 patchlevel 0 [08/10/2018]
2. non ssh connections work as expected (moderncommand.com 4201)
3. when trying to connect, connect.log reads:

Got new connection on SSL port from 83.28.6.XX.
ssl_slave: Lost SSL connection from 83.28.6.XX. State: 0, reason 0x20.

4. the javascript console error from mush-portal on my site (moderncommand.com) is:

failed: Error in connection establishment: net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH

5. openssl version: OpenSSL 1.0.2g 1 Mar 2016

EDIT: 6. in the apache error.log is a more interesting error:

AH02032: Hostname m provided via SNI and hostname moderncommand.com provided via HTTP have no compatible SSL setup

moderncommand.com is running as one of many virtual hosts on the same server, so I suspect I may have used the wrong hostname when creating the SSL certificates. I'll try using another and update this issue as I go I learned a bit about this error at this stackexchange link.

Is there a way to test my ssl so I can diagnose this issue a little better?

I know this a volunteer project for you, and I very much appreciate any help and support you might offer.

Warmly,

Bill

[grapenut]

Hi Bill,

I can login to the SSL port using TinyFugue so it looks like you have things configured properly, however the self-signed certs from that README are not ideal. Many browsers will reject them outright, and the ones that don't will require users to manually install/trust the certificate. I would suggest either using the same cert that's being used for the HTTPS portion of your website, or if that's not available get a trusted cert from one of the authorities.

The best place to get universally accepted free certs is letsencrypt.org. The only issue is that they expire after 90 days or so. If you have root access on the host, there is a command-line tool called certbot that you can use to obtain a new cert and automatically renew it. You'll have to remember to go in and concatenate them together and replace the MUSH's cert whenever they renew, though that too can be automated. Once you use certbot to register a new certificate, you'll find them in /etc/letsencrypt/live/moderncommand.com/ as cert.pem and privkey.pem.

On another note, when I browse to https://moderncommand.com it is attempting to connect to the regular port. There is some code in local.js that allows you to check if the browser is using HTTPS and adjust the port number. The serverPort line should look like

client.defaultSettings.serverPort = urlSSL ? '4202' : '4201';

Please let me know if you have any trouble obtaining a certificate or getting connected after you've gotten one. If you don't have root access, you can still use letsencrypt but it won't be nearly as automatic.

Cheers,
-grapenut

[bmackenty]

wow!

Thank you for the answer. I tried a bit using a new cert (and then the existing one), but to no avail. One of my challenges is finding 2 or 3 uninterrupted hours to focus soley on this issue :-)

My current quick-fix is to remove the https redirection and serve the site as http. I understand the risks, and when I have time I will re-attend to this issue.

Thank you again for your helpful and thoughtful reply.

Warmly,

Bill

[HarryCordewener]

The way I solved this was to create a separate SSL port on nginx that downgrades to http behind it, and sends it to the http port. However, I've discovered that this so far leads to 10m (exact) timeouts, even during activity.

Edit: And I can't tell what process is cutting it.