Static address SSL certificate overwritten internally by internetbox.swisscom.ch certificate

Foleiwu64

Hello, I hope I’m knocking on the good door 🙂

Since a few year, I’ve set up, thanks to the static URL (DynDNS) offered with my subscription (myUrl.internet-box.ch), a few services that I access on the web, and that I’ve secured thanks to a certificat signed by the simple cheap certbot, provided by reverse proxies that encapsulate my internal http communication.

However, since a few months ago (but I noticed only the reason today😃), I see that my certificat (signed for myUrl.internet-box.ch) given by my reverse proxies is being overriden by the internetbox.swisscom.ch certificat inside my home network, making all my services not happy at all when I use them within my home.

To note - this is only an issue inside my home network. I guess there is some DNS/network rule here or there that is redirecting any 192.168.1.X stuff to an internal internetbox.swisscom.ch with an internal internetbox.swisscom.ch certificat.

It could be that’s it’s my reverse proxies configurations that really aren’t top notch.

Here would be an example of one of my configuration:

server {

    listen 446;
    server_name myUrl.internet-box.ch;

    ssl_certificate           /etc/letsencrypt/live/...;
    ssl_certificate_key       /etc/letsencrypt/live/...;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8096;

      proxy_redirect      http://localhost:8096 https://myUrl.internet-box.ch;
    }
}

I stay but a simple amateur in networking, so if you see anything wrong with this, don’t hesitate.

May someone has any idea? Maybe I could find what is doing this redirection/certificate pushing inside my network?

r00t

Hi @Foleiwu64

That sounds very interesting - can you also share the port-forwarding config on the internet-box itself? (I would like to see if I can reproduce this behaviour)

When you access the services from your internal network, does the box redirect you to its GUI or does it serve your services with the “wrong” certificate?

Best,

r00t

Foleiwu64

Hello r00t, thx for answering 🙂

Here’s a few example of my port forwarding:

As you can see, there’s a slight port shift in the port-forwarding, then later in the reverse proxy, I shift it also to internal port 8096 (or others, depending on the service).

Now that you mention it, I’m not even sure if I’m being redirected, when I access [https://myUri.internet-box.ch](https://myUri.internet-box.ch,) (from inside the network). I get Empty Responses on port 443, and connection refused on others. This indeed highly seems like I’m being redirected to the box!

I only found out the certificate wasn’t the good one from the empty response on 443 - I may have searched in the wrong direction.

r00t

Hi @Foleiwu64

I tried to reproduce it, but it seems to work for me as expected:

- Accessing port 443 on the internal IP of the Internetbox brings me to the webinterface.

- Accessing port 443 on the public IP of the Internetbox gets portforwarded to the device.

- Accessing the myhostname.internet-box.ch hostname resolves the public IP.

The following things come to mind:

If you are using your own DNS-server (i.E. PiHole) it should not rewrite your public IP with the internal IP of the internet-box
- verify using the dig command: dig myhostname.internet-box.ch @ip-of-your-dns-server
- Please note that there are also firewalls that inspect and change DNS-traffic.
The internet-box does not incorrectly rewrite the hostname
- also verify using the dig command: dig myhostname.internet-box.ch @192.168.1.1
what is the output of curl https://myhostname.internet-box.ch -vk

If all of this yields no result, it would be best to describe your network in detail. (which devices are you using in what combination etc.)

Best,

r00t

bitracer

It must be a forwarding issue. I have a similar setup and it works as expected.

Fludiegech87

Hi!

I have the very same problem… For some reason the request is intercepted by the internet box when accessing using custom domain from internal network, but everything is fine from outside.

Using the dig command I can see that the host name resolves to the public ip, which should be fine…

Did you get it to work?

Thanks