Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Support
  3. Connection error with Cloudflare proxying

Connection error with Cloudflare proxying

Scheduled Pinned Locked Moved Solved Support
cloudflare
13 Posts 3 Posters 2.9k Views 3 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • girishG girish

    @guyds That could just be a temporary cloudflare proxying/caching issue. Usually turning the proxying on/off in Cloudflare fixes it.

    For the Full (strict) to work, the domain in Cloudron should use one of the automated DNS providers. Does it? Because otherwise, it will have to get certs from Let's Encrypt via HTTP, which won't work when proxying via Cloudflare. You can also check if there are any errors in the browser console. IIRC, there is something like Rocket Loader or something in Cloudflare which has to be disabled. When enabled, Cloudflare injects some javascript which won't load in Cloudron dashboard because of CSP.

    G Offline
    G Offline
    guyds
    wrote on last edited by guyds
    #3

    @girish said in Single domain, multiple cloudrons?:

    @guyds That could just be a temporary cloudflare proxying/caching issue. Usually turning the proxying on/off in Cloudflare fixes it.

    I tried that, but unfortunately that didn't work.

    For the Full (strict) to work, the domain in Cloudron should use one of the automated DNS providers. Does it?
    Because otherwise, it will have to get certs from Let's Encrypt via HTTP, which won't work when proxying via Cloudflare.

    It's using the Cloudflare DNS provider, so that should be ok I guess?

    You can also check if there are any errors in the browser console. IIRC, there is something like Rocket Loader or something in Cloudflare which has to be disabled. When enabled, Cloudflare injects some javascript which won't load in Cloudron dashboard because of CSP.

    Rocket Loader is not enabled and I completely purged the Cloudflare cache, but still it doesn't work when I turn on the CF proxy when using a subdomain for the Cloudron.

    After hitting shift-refresh in the browser (Firefox), I get the following error:

    cloudron_error_when_cf-proxy_enabled_with_subdomain.png

    Edit: to be clear, when I use the main domain everything works fine with the proxy enabled

    girishG 1 Reply Last reply
    0
    • G guyds

      @girish said in Single domain, multiple cloudrons?:

      @guyds That could just be a temporary cloudflare proxying/caching issue. Usually turning the proxying on/off in Cloudflare fixes it.

      I tried that, but unfortunately that didn't work.

      For the Full (strict) to work, the domain in Cloudron should use one of the automated DNS providers. Does it?
      Because otherwise, it will have to get certs from Let's Encrypt via HTTP, which won't work when proxying via Cloudflare.

      It's using the Cloudflare DNS provider, so that should be ok I guess?

      You can also check if there are any errors in the browser console. IIRC, there is something like Rocket Loader or something in Cloudflare which has to be disabled. When enabled, Cloudflare injects some javascript which won't load in Cloudron dashboard because of CSP.

      Rocket Loader is not enabled and I completely purged the Cloudflare cache, but still it doesn't work when I turn on the CF proxy when using a subdomain for the Cloudron.

      After hitting shift-refresh in the browser (Firefox), I get the following error:

      cloudron_error_when_cf-proxy_enabled_with_subdomain.png

      Edit: to be clear, when I use the main domain everything works fine with the proxy enabled

      girishG Offline
      girishG Offline
      girish
      Staff
      wrote on last edited by
      #4

      @guyds If you have CF proxying enabled, then you will always see some Cloudflare UI. Something like below.

      5901341a-ba39-4848-a6fa-d81b8a935904-image.png

      In your case, the Secure Connection Failed, I think means something related to browser/HSTS or something. Can you try in another device/browser or clear the browser cache? In Firefox, it's a bit tricky to clear HSTS. Usually, what I do is open my "History" and then right click on the site and there is a "Forget about this site" option.

      G 1 Reply Last reply
      1
      • girishG girish

        @guyds If you have CF proxying enabled, then you will always see some Cloudflare UI. Something like below.

        5901341a-ba39-4848-a6fa-d81b8a935904-image.png

        In your case, the Secure Connection Failed, I think means something related to browser/HSTS or something. Can you try in another device/browser or clear the browser cache? In Firefox, it's a bit tricky to clear HSTS. Usually, what I do is open my "History" and then right click on the site and there is a "Forget about this site" option.

        G Offline
        G Offline
        guyds
        wrote on last edited by
        #5

        @girish You're right, it seems to be related to Firefox.
        I tried on 4 different pc's, both regular and private mode, and always that same error. So it has nothing to do with caching but with Firefox in general 🤔
        When I use chrome or another chrome based browser it works fine.

        girishG 1 Reply Last reply
        0
        • G guyds

          @girish You're right, it seems to be related to Firefox.
          I tried on 4 different pc's, both regular and private mode, and always that same error. So it has nothing to do with caching but with Firefox in general 🤔
          When I use chrome or another chrome based browser it works fine.

          girishG Offline
          girishG Offline
          girish
          Staff
          wrote on last edited by
          #6

          @guyds oh maybe https://appuals.com/how-to-fix-ssl_error_no_cypher_overlap/

          G 1 Reply Last reply
          0
          • girishG girish

            @guyds oh maybe https://appuals.com/how-to-fix-ssl_error_no_cypher_overlap/

            G Offline
            G Offline
            guyds
            wrote on last edited by
            #7

            @girish thanks for that link.
            However, in the meantime I'm experiencing the same issue with the chrome based browsers.

            So to summarize:
            When I use a regular domain there are no issues.
            When I switch to a subdomain, the Cloudron isn't accessible anymore on Firefox, but on chrome based browsers it works.
            After 10 or 15 mins however, I'm getting a similar error on the Chrome based browsers.
            When I turn of the CF proxy for the subdomain, it also works fine in any browser.

            So there definitely seems to be an issue with proxying a sub-sub-domain (my.sub.domain.tld) through CF.

            girishG 1 Reply Last reply
            0
            • G guyds

              @girish thanks for that link.
              However, in the meantime I'm experiencing the same issue with the chrome based browsers.

              So to summarize:
              When I use a regular domain there are no issues.
              When I switch to a subdomain, the Cloudron isn't accessible anymore on Firefox, but on chrome based browsers it works.
              After 10 or 15 mins however, I'm getting a similar error on the Chrome based browsers.
              When I turn of the CF proxy for the subdomain, it also works fine in any browser.

              So there definitely seems to be an issue with proxying a sub-sub-domain (my.sub.domain.tld) through CF.

              girishG Offline
              girishG Offline
              girish
              Staff
              wrote on last edited by
              #8

              @guyds You can check curl https://my.sub.domain.tld with CF proxying turned on. If that doesn't work (gives some TLS/TLS warnings), you can simply open a ticket with Cloudflare.

              G 1 Reply Last reply
              0
              • girishG girish

                @guyds You can check curl https://my.sub.domain.tld with CF proxying turned on. If that doesn't work (gives some TLS/TLS warnings), you can simply open a ticket with Cloudflare.

                G Offline
                G Offline
                guyds
                wrote on last edited by
                #9

                @girish That doesn't work either:

                curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
                

                So I'll open a ticket with CF.

                Thanks for following up on this issue!

                1 Reply Last reply
                0
                • G Offline
                  G Offline
                  guyds
                  wrote on last edited by
                  #10

                  Ok, so I was correct when I said I seemed to remember there are some limitations with CF proxy and subdomains in the free plan.
                  When trying to open a ticket with CF regarding this issue I was pointed to the following link on their community:
                  https://community.cloudflare.com/t/subdomain-too-deep/81872

                  The certificates available with the free account (universal certificates) cover only one level of subdomains so my.domain.tld is covered, but my.sub.domain.tld isn't.

                  girishG 1 Reply Last reply
                  3
                  • G guyds

                    Ok, so I was correct when I said I seemed to remember there are some limitations with CF proxy and subdomains in the free plan.
                    When trying to open a ticket with CF regarding this issue I was pointed to the following link on their community:
                    https://community.cloudflare.com/t/subdomain-too-deep/81872

                    The certificates available with the free account (universal certificates) cover only one level of subdomains so my.domain.tld is covered, but my.sub.domain.tld isn't.

                    girishG Offline
                    girishG Offline
                    girish
                    Staff
                    wrote on last edited by
                    #11

                    @guyds Ah, good to know. Did not know this limitation!

                    humptydumptyH 1 Reply Last reply
                    0
                    • girishG girish

                      @guyds Ah, good to know. Did not know this limitation!

                      humptydumptyH Offline
                      humptydumptyH Offline
                      humptydumpty
                      wrote on last edited by
                      #12

                      @girish I just ran into this issue and I'm glad I found this thread. Can you please add the limitation as a note to the docs. TIA! https://docs.cloudron.io/domains/#cloudflare-dns

                      girishG 1 Reply Last reply
                      1
                      • humptydumptyH humptydumpty

                        @girish I just ran into this issue and I'm glad I found this thread. Can you please add the limitation as a note to the docs. TIA! https://docs.cloudron.io/domains/#cloudflare-dns

                        girishG Offline
                        girishG Offline
                        girish
                        Staff
                        wrote on last edited by
                        #13

                        @humptydumpty done

                        1 Reply Last reply
                        1
                        Reply
                        • Reply as topic
                        Log in to reply
                        • Oldest to Newest
                        • Newest to Oldest
                        • Most Votes


                        • Login

                        • Don't have an account? Register

                        • Login or register to search.
                        • First post
                          Last post
                        0
                        • Categories
                        • Recent
                        • Tags
                        • Popular
                        • Bookmarks
                        • Search