# Reverse Proxy SSL Struggle

**URL:** <https://discourse.libretime.org/t/reverse-proxy-ssl-struggle/1725>\
**Category:** Get Help\
**Created:** [August 4, 2024, 4:19pm UTC](https://discourse.libretime.org/t/reverse-proxy-ssl-struggle/1725 "2024-08-04T16:19:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![max-von-aigner](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.libretime.org/max-von-aigner/32/786_2.png) [@max-von-aigner](https://discourse.libretime.org/u/max-von-aigner)\
**Post date:** [August 4, 2024, 4:19pm UTC](https://discourse.libretime.org/t/reverse-proxy-ssl-struggle/1725/1 "2024-08-04T16:19:21Z")

</div>

Hi community,

I’m struggling to get the HTTPS connection to run for my LibreTime server, which runs on [radiotnp.com](http://radiotnp.com/).

The Icecast part of my server seems to be secured, at least I’m assuming so, because I see the Icecast admin login when I go to [radiotnp.com:8443](http://radiotnp.com:8443/).

When I go to [radiotnp.com](http://radiotnp.com/) however, I get a 500 http error -

Here are the steps I followed:

- I installed LibreTime on Ubuntu 20.4 on a new Digital Ocean droplet, using the LibreTime installer.
- Before I ran the installer, I secured my page [radiotnp.com](http://radiotnp.com) using Certbot and Nginx reverse proxy as per the install docs.
- I added all relevant ports to the firewall allowed ports:

```bash
root@radio-tnp-ubuntu-server:/etc# sudo ufw status
Status: active

To Action From
-- ------ ----
Nginx Full ALLOW Anywhere
22/tcp ALLOW Anywhere
22,80,8000/tcp ALLOW Anywhere
8001,8002/tcp ALLOW Anywhere
8443/tcp ALLOW Anywhere
443/tcp ALLOW Anywhere
8080 ALLOW Anywhere
Nginx Full (v6) ALLOW Anywhere (v6)
22/tcp (v6) ALLOW Anywhere (v6)
22,80,8000/tcp (v6) ALLOW Anywhere (v6)
8001,8002/tcp (v6) ALLOW Anywhere (v6)
8443/tcp (v6) ALLOW Anywhere (v6)
443/tcp (v6) ALLOW Anywhere (v6)
8080 (v6) ALLOW Anywhere (v6)

```

Here’s the Ngingx /nginx/sites-eneabled/radiotnp.com.conf:

```bash
server {
    listen 80;
    server_name radiotnp.com;

    client_max_body_size 512M;
    client_body_timeout 300s;

    if ($host = radiotnp.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    return 404; # managed by Certbot
}

server {
    listen 443 ssl;
    server_name radiotnp.com;

    ssl_certificate /etc/letsencrypt/live/radiotnp.com/fullchain.pem; # m>
    ssl_certificate_key /etc/letsencrypt/live/radiotnp.com/privkey.pem; #>
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    client_max_body_size 512M;
    client_body_timeout 300s;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

        proxy_pass http://localhost:8080/;

    }
}

```

These are the error logs of Nginx:

```bash
root@radio-tnp-ubuntu-server:/etc# sudo tail /var/log/nginx/libretime.error.log
2024/08/04 17:55:25 [error] 785571#785571: *77 FastCGI sent in stderr: "PHP message: PHP Fatal error: Uncaught ErrorException: yaml_parse_file(): parsing error encountered during parsing: did not find expected key (line 212, column 7), context while parsing a block mapping (line 204, column 7) in /usr/share/libretime/legacy/application/configs/conf.php:238
Stack trace:
#0 [internal function]: exception_error_handler()
#1 /usr/share/libretime/legacy/application/configs/conf.php(238): yaml_parse_file()
#2 /usr/share/libretime/legacy/application/configs/conf.php(427): Config::load()
#3 /usr/share/libretime/legacy/application/Bootstrap.php(5): Config::getConfig()
#4 /usr/share/libretime/legacy/vendor/zf1s/zend-application/library/Zend/Application.php(340): require_once('/usr/share/libr...')
#5 /usr/share/libretime/legacy/vendor/zf1s/zend-application/library/Zend/Application.php(202): Zend_Application->setBootstrap()
#6 /usr/share/libretime/legacy/vendor/zf1s/zend-application/library/Zend/Application.php(99): Zend_Application->setOptions()
#7 /usr/share/libretime/legacy/a" while reading response header from upstream, client: 79.110.62.113, server: , request: "GET http://example.com/ HTTP/1.1", upstream: "fastcgi://unix:/run/libretime-legacy.sock:", host: "example.com"

```

Previously, I used to get a “SSL handshake failed” error - not sure what exactly changed tough, so that the “SSL handshake failed” is not there anymore.

I have tried every possible solution from the docs and community and I’m completely lost at this point. If installed LibreTime 4 times on new droplets, but can’t fix the SSL issue.

What should I check?

If someone can help me out here, I’d massively appreciate it!

---

<div class="post-metadata">

**Author:** ![joola](https://avatars.discourse-cdn.com/v4/letter/j/cab0a1/32.png) [@joola](https://discourse.libretime.org/u/joola)\
**Post date:** [August 9, 2024, 11:39am UTC](https://discourse.libretime.org/t/reverse-proxy-ssl-struggle/1725/2 "2024-08-09T11:39:17Z")

</div>

The error logs show the config file could not be parsed, I’d first try to fix this before trying to work on the reverse proxy.

---

<div class="post-metadata">

**Author:** ![max-von-aigner](https://yyz2.discourse-cdn.com/flex036/user_avatar/discourse.libretime.org/max-von-aigner/32/786_2.png) [@max-von-aigner](https://discourse.libretime.org/u/max-von-aigner)\
**Post date:** [August 13, 2024, 11:48pm UTC](https://discourse.libretime.org/t/reverse-proxy-ssl-struggle/1725/3 "2024-08-13T23:48:44Z")

</div>

Hey Joola, thanks for your reply!

I restarted the installation with a few checks in between - I got everything installed and accessible with HTTP, without a hitch ✅

I then configured the reverse proxy and was still able to see the LibreTime admin login page, when accessing my server through HTTPS ✅

After I secured my Icecast instance, the server returns a 500 error in the browser and I get these error logs in Nginx:

```auto
root@radio-tnp-libretime-server:/etc/nginx/sites-available# sudo tail -f /var/log/nginx/error.log
2024/08/14 00:37:59 [crit] 44421#44421: *256 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client: 157.245.36.108, server: 0.0.0.0:443
2024/08/14 00:38:10 [crit] 44421#44421: *635 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client: 146.70.197.150, server: 0.0.0.0:443
2024/08/14 00:39:28 [notice] 44865#44865: signal process started
2024/08/14 00:40:01 [crit] 44866#44866: *920 SSL_do_handshake() failed (SSL: error:14201044:SSL routines:tls_choose_sigalg:internal error) while SSL handshaking, client: 64.41.200.103, server: 0.0.0.0:443
2024/08/14 00:42:49 [notice] 45137#45137: signal process started
2024/08/14 00:42:52 [notice] 45141#45141: signal process started
2024/08/14 00:42:57 [notice] 45143#45143: signal process started
2024/08/14 01:14:34 [notice] 48018#48018: signal process started
2024/08/14 01:14:37 [notice] 48033#48033: signal process started
2024/08/14 01:14:43 [notice] 48070#48070: signal process started
^C

```

And this here is my UFW status:

```auto
root@radio-tnp-libretime-server:/etc/nginx/sites-available# sudo ufw status
Status: active

To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
Nginx Full ALLOW Anywhere
8443/tcp ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Nginx Full (v6) ALLOW Anywhere (v6)
8443/tcp (v6) ALLOW Anywhere (v6)

```

I added the Icecast secure port 8443 to the firewall after bundling the certs and adding them.

Do you have any ideas what I should check next?