I`m testing Cloudflare Tunnel and when I use service http://localhost:80 everything works fine, however when I sue service: https://localhost:443 it does not, I know Cloudflare Tunnel is already SSL but still want to test.
Cloudflared version ( When I run in from cli it says it is old but this is latest I could download from dev anyway )
root@OVH-1:~# cloudflared --v
cloudflared version 2021.5.9 (built 2021-05-21-1541 UTC)
root@OVH-1:~#
Cloudflared Config:
root@OVH-1:~# cat /etc/cloudflared/config.yml
tunnel: 46e47211-d901-4306-a596-c21df1b85c01
credentials-file: /root/.cloudflared/46e47211-d901-4306-a596-c21df1b85c01.json
ingress:
- hostname: www.mpabian.co.uk
service: https://localhost:443
- hostname: www.mpabian.uk
service: http://localhost:80
- service: http_status:404
When I test Rules it shows correct service:
root@OVH-1:~# cloudflared tunnel --config /etc/cloudflared/config.yml ingress rule https://www.mpabian.co.uk
Using rules from /etc/cloudflared/config.yml
Matched rule #1
hostname: www.mpabian.co.uk
service: https://localhost:443
root@OVH-1:~#
When I curl it with localhost it works fine:
root@OVH-1:~# curl https://localhost:443 -H "host:www.mpabian.co.uk" -Ivk
* Trying ::1...
* TCP_NODELAY set
* Expire in 149998 ms for 3 (transfer 0x55e9370cdf90)
* Expire in 200 ms for 4 (transfer 0x55e9370cdf90)
* Connected to localhost (::1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: O=CloudFlare, Inc.; OU=CloudFlare Origin CA; CN=CloudFlare Origin Certificate
* start date: Jun 15 13:37:00 2021 GMT
* expire date: Jun 11 13:37:00 2036 GMT
* issuer: C=US; O=CloudFlare, Inc.; OU=CloudFlare Origin SSL Certificate Authority; L=San Francisco; ST=California
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> HEAD / HTTP/1.1
> Host:www.mpabian.co.uk
> User-Agent: curl/7.64.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Wed, 30 Jun 2021 13:44:13 GMT
Date: Wed, 30 Jun 2021 13:44:13 GMT
< Server: Apache/2.4.38 (Debian)
Server: Apache/2.4.38 (Debian)
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8
<
* Connection #0 to host localhost left intact
Only way I was able to make it over SSL through tunnel it is with this config, also I had to add no-tls-verify: true despite i`m hosting ORGIN Certificate from Cloudlfare
root@OVH-1:~# cat /etc/cloudflared/config.yml
tunnel: 46e47211-d901-4306-a596-c21df1b85c01
credentials-file: /root/.cloudflared/46e47211-d901-4306-a596-c21df1b85c01.json
hostname: www.mpabian.co.uk
url: https://localhost:443
no-tls-verify: true
For any subdomain using just http://localhost:random-port this seems to be working fine
strange
