[GH-ISSUE #1151] Hello, how can I set my certificate to Netbird and a custom SSL port? #1976

New Issue

@Pinkpiglet commented on GitHub (Sep 16, 2023):

The port has been changed, but there will be a 401 error message

@Pinkpiglet commented on GitHub (Sep 16, 2023): ![image](https://github.com/netbirdio/netbird/assets/38532706/3f8ed080-4d72-4530-b01e-38fbcc4e7942) The port has been changed, but there will be a 401 error message

saavagebueno commented

@surik commented on GitHub (Sep 18, 2023):

Hi @Pinkpiglet, could you please take a look at the error logs of the management service via docker-compose logs management? Also, can you share more about your IDP setup?

@surik commented on GitHub (Sep 18, 2023): Hi @Pinkpiglet, could you please take a look at the error logs of the management service via `docker-compose logs management`? Also, can you share more about your IDP setup?

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 18, 2023):

Hello, this is Management.json and related error messages.

{
"Stuns": [
{
"Proto": "udp",
"URI": "stun:netbird.xxxx.com:3478",
"Username": "",
"Password": null
}
],
"TURNConfig": {
"Turns": [
{
"Proto": "udp",
"URI": "turn:netbird.xxxx.com:3478",
"Username": "self",
"Password": "GwbSf9uOYN6OQilqNnXzV8xU2sgjPnyuZq0hut1WRXc"
}
],
"CredentialsTTL": "12h",
"Secret": "secret",
"TimeBasedCredentials": false
},
"Signal": {
"Proto": "http",
"URI": "netbird.xxxx.com:10000",
"Username": "",
"Password": null
},
"Datadir": "",
"HttpConfig": {
"Address": "0.0.0.0:33073",
"AuthIssuer": "https://authentik.xxxx.com:9443/application/o/netbird/",
"AuthAudience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"AuthKeysLocation": "https://authentik.xxxx.com:9443/application/o/netbird/jwks/",
"AuthUserIDClaim": "",
"CertFile":"/etc/letsencrypt/live/netbird.xxxx.com/fullchain.pem",
"CertKey":"/etc/letsencrypt/live/netbird.xxxx.com/privkey.pem",
"OIDCConfigEndpoint":"https://authentik.xxxx.com:9443/application/o/netbird/.well-known/openid-configuration"
},
"IdpManagerConfig": {
"ManagerType": "authentik",
"ClientConfig": {
"Issuer": "https://authentik.xxxx.com:9443/application/o/netbird/",
"TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/",
"ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"ClientSecret": "",
"GrantType": "client_credentials"
},
"ExtraConfig": {
"Password": "QW4TqXjF7JD5VTj1NH0KQzovk1FYBK8U36GscTKCdT7vxuDpGLkjcGi968H4",
"Username": "Netbird"
}
},
"DeviceAuthorizationFlow": {
"Provider": "hosted",
"ProviderConfig": {
"Audience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"Domain": "",
"ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/",
"DeviceAuthEndpoint": "https://authentik.xxxx.com:9443/application/o/device/",
"Scope": "openid",
"UseIDToken": false
}
},
"PKCEAuthorizationFlow": {
"ProviderConfig": {
"Audience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ",
"ClientSecret": "",
"AuthorizationEndpoint": "https://authentik.xxxx.com:9443/application/o/authorize/",
"TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/",
"Scope": "openid profile email offline_access api",
"RedirectURLs": ["http://localhost:53000"],
"UseIDToken": false
}
}
}

@surik

@Pinkpiglet commented on GitHub (Sep 18, 2023): Hello, this is Management.json and related error messages. { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.xxxx.com:3478", "Username": "", "Password": null } ], "TURNConfig": { "Turns": [ { "Proto": "udp", "URI": "turn:netbird.xxxx.com:3478", "Username": "self", "Password": "GwbSf9uOYN6OQilqNnXzV8xU2sgjPnyuZq0hut1WRXc" } ], "CredentialsTTL": "12h", "Secret": "secret", "TimeBasedCredentials": false }, "Signal": { "Proto": "http", "URI": "netbird.xxxx.com:10000", "Username": "", "Password": null }, "Datadir": "", "HttpConfig": { "Address": "0.0.0.0:33073", "AuthIssuer": "https://authentik.xxxx.com:9443/application/o/netbird/", "AuthAudience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "AuthKeysLocation": "https://authentik.xxxx.com:9443/application/o/netbird/jwks/", "AuthUserIDClaim": "", "CertFile":"/etc/letsencrypt/live/netbird.xxxx.com/fullchain.pem", "CertKey":"/etc/letsencrypt/live/netbird.xxxx.com/privkey.pem", "OIDCConfigEndpoint":"https://authentik.xxxx.com:9443/application/o/netbird/.well-known/openid-configuration" }, "IdpManagerConfig": { "ManagerType": "authentik", "ClientConfig": { "Issuer": "https://authentik.xxxx.com:9443/application/o/netbird/", "TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/", "ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "ClientSecret": "", "GrantType": "client_credentials" }, "ExtraConfig": { "Password": "QW4TqXjF7JD5VTj1NH0KQzovk1FYBK8U36GscTKCdT7vxuDpGLkjcGi968H4", "Username": "Netbird" } }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "Audience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "Domain": "", "ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/", "DeviceAuthEndpoint": "https://authentik.xxxx.com:9443/application/o/device/", "Scope": "openid", "UseIDToken": false } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "ClientID": "rEy9QLhxhRQyvqVyBUkVJdqUE22i0PfYVMa2G5sZ", "ClientSecret": "", "AuthorizationEndpoint": "https://authentik.xxxx.com:9443/application/o/authorize/", "TokenEndpoint": "https://authentik.xxxx.com:9443/application/o/token/", "Scope": "openid profile email offline_access api", "RedirectURLs": ["http://localhost:53000"], "UseIDToken": false } } } ![image](https://github.com/netbirdio/netbird/assets/38532706/a1adaf7c-7748-4b27-842f-8f401e1743e4) @surik

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 18, 2023):

I guess it should be related to this:

Grant_types_supported:[
Authorization_code ",
Refresh_token,
Implicit,
Client_credentials ",
Password,
Urn: ietf: params: oauth: grant type: device_code
] @surik

@Pinkpiglet commented on GitHub (Sep 18, 2023): I guess it should be related to this: Grant_types_supported:[ Authorization_code ", Refresh_token, Implicit, **Client_credentials ",** Password, Urn: ietf: params: oauth: grant type: device_code ] @surik

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 18, 2023):

It has been resolved and is indeed related to the authentication jwt encryption certificate.
@surik

@Pinkpiglet commented on GitHub (Sep 18, 2023): ![image](https://github.com/netbirdio/netbird/assets/38532706/cf5c6880-28b6-4047-97ef-d0105dcf1510) ![image](https://github.com/netbirdio/netbird/assets/38532706/dbb930ec-a3d0-4d5f-b465-526da7150263) It has been resolved and is indeed related to the authentication jwt encryption certificate. @surik

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 19, 2023):

@surik Two devices are already online, but they cannot ping each other. Which service's logs do I need to view?

@Pinkpiglet commented on GitHub (Sep 19, 2023): @surik Two devices are already online, but they cannot ping each other. Which service's logs do I need to view?

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 19, 2023):

@Pinkpiglet commented on GitHub (Sep 19, 2023): ![image](https://github.com/netbirdio/netbird/assets/38532706/3ab3d588-5599-4a3a-bea0-6f53aeadb549)

saavagebueno commented

@surik commented on GitHub (Sep 19, 2023):

@Pinkpiglet thank you for providing extensive information. In this case, I would start with /var/log/netbird/client.log(on Windows whatever you see as default for --log-file in netbird service --help) of the machine that is not able to ping.

@surik commented on GitHub (Sep 19, 2023): @Pinkpiglet thank you for providing extensive information. In this case, I would start with `/var/log/netbird/client.log`(on Windows whatever you see as default for `--log-file` in `netbird service --help`) of the machine that is not able to ping.

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 19, 2023):

@surik
windows11：

debian12

@Pinkpiglet commented on GitHub (Sep 19, 2023): @surik windows11： ![image](https://github.com/netbirdio/netbird/assets/38532706/aaf70dd5-9cd5-46aa-b99a-ec7bbd988e14) debian12 ![image](https://github.com/netbirdio/netbird/assets/38532706/57f05bf7-b5e3-49c4-bb3f-1e3ffdf94246)

saavagebueno commented

@surik commented on GitHub (Sep 19, 2023):

@Pinkpiglet that might be a TURN issue. Can you perform the same test as described in this comment? https://github.com/netbirdio/netbird/issues/798#issuecomment-1502430133

@surik commented on GitHub (Sep 19, 2023): @Pinkpiglet that might be a TURN issue. Can you perform the same test as described in this comment? https://github.com/netbirdio/netbird/issues/798#issuecomment-1502430133

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@surik

Prompted authentication failures

@Pinkpiglet commented on GitHub (Sep 20, 2023): @surik ![image](https://github.com/netbirdio/netbird/assets/38532706/1ad6e12e-063f-4bb4-b950-df8dd4c0b061) Prompted authentication failures

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

@Pinkpiglet Yes, looks like TURN is not configured properly. Maybe you can try to change the password and restart the TURN service? Please let me know if this works.

@surik commented on GitHub (Sep 20, 2023): @Pinkpiglet Yes, looks like TURN is not configured properly. Maybe you can try to change the password and restart the TURN service? Please let me know if this works.

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@surik

After resetting the port and password, the test was normal, but still unable to ping the other party's device

@Pinkpiglet commented on GitHub (Sep 20, 2023): @surik ![image](https://github.com/netbirdio/netbird/assets/38532706/7fb468df-805c-4f4c-8ff0-875508f30af1) After resetting the port and password, the test was normal, but still unable to ping the other party's device

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

@Pinkpiglet did you restart the netibird service on the machine? What is the output of the status command now?

@surik commented on GitHub (Sep 20, 2023): @Pinkpiglet did you restart the netibird service on the machine? What is the output of the status command now?

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@surik

@Pinkpiglet commented on GitHub (Sep 20, 2023): @surik ![image](https://github.com/netbirdio/netbird/assets/38532706/0b03e5f7-53a0-470f-b04c-df9ac0938e44)

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@surik The service has been restarted

@Pinkpiglet commented on GitHub (Sep 20, 2023): @surik The service has been restarted

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

@Pinkpiglet please show the output of the status command I'm assuming that we have TURN properly up and running we can see something new there

@surik commented on GitHub (Sep 20, 2023): @Pinkpiglet please show the output of the status command I'm assuming that we have TURN properly up and running we can see something new there

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

@Pinkpiglet Also, could you confirm that the TURN credentials are in sync in management.json and turnserver.conf and that both services restarted?

@surik commented on GitHub (Sep 20, 2023): @Pinkpiglet Also, could you confirm that the TURN credentials are in sync in `management.json` and `turnserver.conf` and that both services restarted?

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@Pinkpiglet Also, could you confirm that the TURN credentials are in sync in management.json and turnserver.conf and that both services restarted?

Yes, all have been restarted.

@Pinkpiglet commented on GitHub (Sep 20, 2023): > @Pinkpiglet Also, could you confirm that the TURN credentials are in sync in `management.json` and `turnserver.conf` and that both services restarted? Yes, all have been restarted.

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

@Pinkpiglet please show the output of the status command I'm assuming that we have TURN properly up and running we can see something new there

@Pinkpiglet commented on GitHub (Sep 20, 2023): > @Pinkpiglet please show the output of the status command I'm assuming that we have TURN properly up and running we can see something new there ![image](https://github.com/netbirdio/netbird/assets/38532706/14d45b2e-988c-4534-91a7-322ae3f2d6d4) ![image](https://github.com/netbirdio/netbird/assets/38532706/fc1bbfbd-e001-4b7b-a12d-ffcddabde323)

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

@Pinkpiglet thank you. I will need more logs to understand how the status of connection from netbird to TURN. On the Linux machines can you do the following:

sudo mkdir -p /etc/sysconfig
echo 'PIONS_LOG_DEBUG=all' | sudo tee -a /etc/sysconfig/netbird
echo 'NB_LOG_LEVEL=debug' | sudo tee -a /etc/sysconfig/netbird
sudo netbird service restart

After at least 1 minute please collect the following files:

/var/log/netbird/client.log
/var/log/netbird/netbird.out
/var/log/netbird/netbird.err

You can share them here or another option is to join our Slack group.

@surik commented on GitHub (Sep 20, 2023): @Pinkpiglet thank you. I will need more logs to understand how the status of connection from netbird to TURN. On the Linux machines can you do the following: ``` sudo mkdir -p /etc/sysconfig echo 'PIONS_LOG_DEBUG=all' | sudo tee -a /etc/sysconfig/netbird echo 'NB_LOG_LEVEL=debug' | sudo tee -a /etc/sysconfig/netbird sudo netbird service restart ``` After at least 1 minute please collect the following files: ``` /var/log/netbird/client.log /var/log/netbird/netbird.out /var/log/netbird/netbird.err ``` You can share them here or another option is to join our [Slack group](https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A).

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

/var/log/netbird/

netbird.log

client.log

@Pinkpiglet commented on GitHub (Sep 20, 2023): > /var/log/netbird/ [netbird.log](https://github.com/netbirdio/netbird/files/12675820/netbird.log) [client.log](https://github.com/netbirdio/netbird/files/12675810/client.log)

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host
ice WARNING: 2023/09/21 01:08:25 Failed to build new turn.Client netbird.xxxx.com:3478 lookup netbird.xxxx.com on 114.114.114.114:53: no such host
ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host

The machine you used to test with https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ was able to resolve that domain. Wonder why this is not the case for the instance above.

@surik commented on GitHub (Sep 20, 2023): ``` ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host ice WARNING: 2023/09/21 01:08:25 Failed to build new turn.Client netbird.xxxx.com:3478 lookup netbird.xxxx.com on 114.114.114.114:53: no such host ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host ``` The machine you used to test with https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ was able to resolve that domain. Wonder why this is not the case for the instance above.

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 20, 2023):

ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host
ice WARNING: 2023/09/21 01:08:25 Failed to build new turn.Client netbird.xxxx.com:3478 lookup netbird.xxxx.com on 114.114.114.114:53: no such host
ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host

您用来测试https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ 的机器能够解析该域。想知道为什么上面的例子不是这种情况。

I have used another server and it is already possible, but the Windows client cannot access the network with routing settings, and my phone can access it.

@Pinkpiglet commented on GitHub (Sep 20, 2023): > ``` > ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host > ice WARNING: 2023/09/21 01:08:25 Failed to build new turn.Client netbird.xxxx.com:3478 lookup netbird.xxxx.com on 114.114.114.114:53: no such host > ice WARNING: 2023/09/21 01:08:25 failed to resolve stun host: netbird.xxxx.com:3478: lookup netbird.xxxx.com on 114.114.114.114:53: no such host > ``` > > 您用来测试[https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/ 的](https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/)机器能够解析该域。想知道为什么上面的例子不是这种情况。 I have used another server and it is already possible, but the Windows client cannot access the network with routing settings, and my phone can access it. ![image](https://github.com/netbirdio/netbird/assets/38532706/9405a946-a5b8-4e94-94a2-d80c154e259a)

saavagebueno commented

@surik commented on GitHub (Sep 20, 2023):

Unfortunately, only Linux is supported as a routing peers right now.

@surik commented on GitHub (Sep 20, 2023): Unfortunately, only Linux is supported as a [routing peers](https://docs.netbird.io/how-to/routing-traffic-to-private-networks#routing-peer) right now.

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 24, 2023):

不幸的是，目前仅支持 Linux 作为路由对等点。

Approximately when will this support the Windows system

@Pinkpiglet commented on GitHub (Sep 24, 2023): > 不幸的是，目前仅支持 Linux 作为[路由对等点。](https://docs.netbird.io/how-to/routing-traffic-to-private-networks#routing-peer) Approximately when will this support the Windows system

saavagebueno commented

@Pinkpiglet commented on GitHub (Sep 24, 2023):

Unfortunately, only Linux is supported as a routing peers right now.

Android client using non 443 port prompts for invalid address

@Pinkpiglet commented on GitHub (Sep 24, 2023): > Unfortunately, only Linux is supported as a [routing peers](https://docs.netbird.io/how-to/routing-traffic-to-private-networks#routing-peer) right now. Android client using non 443 port prompts for invalid address

saavagebueno commented