fkrebs/docs
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

nc.nuclide.systems TLS broken — Zoraxy serving self-signed cert, default.pem expires 2026-05-24 #1

New Issue
Closed
opened 2026-05-23 08:28:53 +00:00 by fkrebs · 1 comment
fkrebs commented 2026-05-23 08:28:53 +00:00
Owner
Copy Link
Copy Source

Symptoms

Brave/Chrome shows HSTS error on nc.nuclide.systems. Zoraxy serving self-signed CN=Zoraxy Self-host cert instead of Let's Encrypt wildcard.

Root cause

  1. nc.nuclide.systems.pem does not exist in /opt/zoraxy/conf/certs/ — no HTTP challenge cert was ever obtained
  2. _.nuclide.systems.pem (wildcard, valid May 21–Aug 19 2026) was renewed but not wired to nc subdomain
  3. default.pem (old wildcard) expires 2026-05-24 (tomorrow)

Fix

On CT 108 (Zoraxy, 192.168.1.4):

cd /opt/zoraxy/conf/certs/
ln -sf _.nuclide.systems.pem nc.nuclide.systems.pem
ln -sf _.nuclide.systems.key nc.nuclide.systems.key
cp _.nuclide.systems.pem default.pem
cp _.nuclide.systems.key default.key
docker restart zoraxy

Requires user confirmation before applying (Zoraxy change policy).

## Symptoms Brave/Chrome shows HSTS error on nc.nuclide.systems. Zoraxy serving self-signed `CN=Zoraxy Self-host` cert instead of Let's Encrypt wildcard. ## Root cause 1. `nc.nuclide.systems.pem` does not exist in `/opt/zoraxy/conf/certs/` — no HTTP challenge cert was ever obtained 2. `_.nuclide.systems.pem` (wildcard, valid May 21–Aug 19 2026) was renewed but not wired to nc subdomain 3. `default.pem` (old wildcard) **expires 2026-05-24** (tomorrow) ## Fix On CT 108 (Zoraxy, 192.168.1.4): ```bash cd /opt/zoraxy/conf/certs/ ln -sf _.nuclide.systems.pem nc.nuclide.systems.pem ln -sf _.nuclide.systems.key nc.nuclide.systems.key cp _.nuclide.systems.pem default.pem cp _.nuclide.systems.key default.key docker restart zoraxy ``` **Requires user confirmation before applying** (Zoraxy change policy).
fkrebs commented 2026-05-23 08:31:23 +00:00
Author
Owner
Copy Link
Copy Source

Fixed 2026-05-23: removed DisableSNI: true from nc.nuclide.systems proxy config in Zoraxy (CT 108). Root cause: SNI disabled prevented Zoraxy from matching the wildcard cert _.nuclide.systems. After restart, cert is now Let's Encrypt CN=nuclide.systems, valid until 2026-08-19. Also refreshed default.pem (was expiring 2026-05-24). Zoraxy-conf committed: e6f2025.

Fixed 2026-05-23: removed `DisableSNI: true` from nc.nuclide.systems proxy config in Zoraxy (CT 108). Root cause: SNI disabled prevented Zoraxy from matching the wildcard cert `_.nuclide.systems`. After restart, cert is now Let's Encrypt `CN=nuclide.systems`, valid until 2026-08-19. Also refreshed `default.pem` (was expiring 2026-05-24). Zoraxy-conf committed: e6f2025.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
fkrebs (Florian Krebs)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fkrebs/docs#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?