Kimserey's blog

Setup HTTPS with Nginx on Azure Ubuntu VM Today we will see how we can setup HTTPS on using Certbot Nginx configuration on an Azure Ubuntu VM. This post will be composed of three steps: Prepare the VM Install Nginx Install Certbot 1. Prepare the VM We start first by creating an Azure VM on Ubuntu 18.04 with either password or SSH and allowing HTTP , HTTPS , SSH . Once done, we can select a custom DNS for our VM. This makes it easier to SSH but also it will be required for our SSL certificate setup. We set the Assignment as Static then we choose a DNS name label. Here we choose azure-test-vm therefore the VM will be accessible at azure-test-vm.southcentralus.cloudapp.azure.com . We should now be able to SSH into the VM using the command: ssh kimserey@azure-test-vm.southcentralus.cloudapp.azure.com 2. Install Nginx Next once we are in the VM, we can install Nginx by installing the following: sudo apt-get update sudo apt-get install nginx Once installed, as we already h...

Nginx 502 bad gateway after SSL setup When proxying a request to an underlying server, it is necessary to validate its SSL certificate. For example, if we have a process running on https://localhost:5001 , we can configure Nginx to validate the certificate used by localhost:5001 . But if we miss one step, we face the common error 502 Bad Gateway returned by Nginx. Today we will see two scenarios where we can face the error and how to fix them: Setup SSL verification Scenario 1: self-signed certificate Scenario 2: upstream server 1. Setup SSL verification We can tell Nginx to verify the underlying SSL by adding the following directives, either on server or location level: server { // ... more config proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; proxy_ssl_verify on; proxy_ssl_session_reuse on; location / { proxy_pass https://localhost:5001/; } } proxy_ssl_trusted_certificate indicates to Nginx the location of the trusted CA certificates...

HTTPS with SSL for Nginx, Kestrel and Angular Internet is moving toward secure connections whereby HTTPS is a priority. Browsers are now warning users when navigating to non secured website. With this movement, Kestrel and ASPNET Core have adopted the mentality of security by default rather than security when needed. HTTPS will now be the default and HTTP will be a necessity due to implementation constraints. Together with Lets Encrypt and ACME protocol, we do not have excuses for not implementing an SSL connection. Setup the example SSL self signed certificate for Nginx SSL self signed certificate for Kestrel SSL self signed certificate for Angular CLI 1. Setup the example We assume that our environment is on Ubuntu, with nginx and dotnet installed. If you are on Windows, you can install the linux subsystem with Ubuntu 16.04 as describe on my previous post . This will give access to most of the features of Ubuntu via a bash prompt. To start we create a HelloWorld applicatio...

SignalR with ASP Net Core SignalR is a framework from ASP NET Core allowing us to establish a two way communication between client and server. This two way communication allows the client to send messages to the server but more importantly allows the server to push messages to the client. SignalR makes use of Websocket when available else it falls back to SSE or pulling. Today we will focus on how to setup SignalR to work with WSS, Websocket secure and how we can authenticate the user requesting to connect to our SignalR hub via Webscoket. Getting started with SignalR SSL encryption for Websocket Secure WSS Websocket Authentication with Identity Server 4 SignalR behind Nginx 1. Getting started with SignalR The Hubs are the main components of SignalR. It is an abstraction of a two way communication available for both client and server. Public functions from the hub can be called from the server code and can be called from the client. The frontend NPM package @aspnet/signalr ...

Self Signed Certificate for Identity Server 4 and SSL in Ubuntu 16.04 server To sign our JWT tokens, Identity Server 4 requires a signing credential. Today we will see how we can create our own key and provide it to Identity Server to be used as signing credential. Configure ASP NET Core Create key with openssl Selfsigned certificate for local SSL usage If you are new to Identity Server, you can have a look at my previous blog post on How to configure a Implicit authentication with Identity Server . 1. Configure ASP NET Core We start first by creating an extension on top of the IIdentityServerBuilder which when the key is available, will load our own key using the .AddSigningCredential() else will create a temporary key for development purposes, .AddDeveloperSigningCredential() . public static class IdentityServerBuilderExtensions { public static IIdentityServerBuilder LoadSigningCredentialFrom(this IIdentityServerBuilder builder, string path) { if (!string...

SSL with Let’s Encrypt Few months ago I explained briefly how SSL could be setup with CloudFlare. Today I would like to share another way to get a SSL certificate for free via a browser based implementation of Let’s Encrypt. This post will be composed by two parts: 1. How SSL works 2. How to get the certificate 1 . How SSL works SSL provides a secure layer on top of HTTP. It allows to encrypt communication between client and server in order to prevent man in the middle attacks and eavesdropping. An SSL is composed by two pieces, a certificate and a private key. The private key must be securely kept by the server while the certificate is distributed to all client. The goal of the SSL is to ensure two things: Encryption of data between server and client Authenticity of the certificate provided 1.1 Encryption of data between server and client The encryption is established by an asymetric key pair. The private key is held by the server while the public key is distributed to ...

Get your domain name and setup SSL with Cloudflare Few weeks ago I explained how to setup a static page and host it on Github for free using github pages. Have a look at it if you missed it https://kimsereyblog.blogspot.co.uk/2016/07/from-idea-to-product-with-websharper-in.html . I also explain how we could get a custom domain name for people to access our website easily. For example I’ve setup a github page with my own name domain https://kimsereylam.com and got it served via HTTP. The problem with setting your own domain name is that your page will not be served with HTTPS. Now for the example website, it is hosted on GitHub and it’s just static data therefore communication encryption isn’t really important. But the issue is that if you share this website to others without specifying the protocol , Chrome will try to open it with HTTPS. And when it does, if you do not serve HTTPS, an ugly error page will show on the browser. This will definitely look bad and more importantly, it ...