NPM with Vaultwarden and self signed cert won't work properly

[vvurzelsepp]

Hi all,
I have some problems with my NPM configuration. First a quick overview of what I have done so far:

1. Installed Vaultwarden via docker.
2. Since my instance should run in my local network only, I chose the method with a private CA and self signed certificates.
3. Configured a proxy in NPM for Vaultwarden.

On Linux and iOS (after importing the root CA) this works flawlessly. The first problem appeared with the macOS application. Once an API call is made, I get an pop up with a pretty generic network error message. I don't know how to trace this further and decided to ignore it for now, since I am mostly on Linux and can use the web app on macOS in the meantime.

In our household there's one person with an Android device, and with the official Bitwarden app I can't connect to the Vaultwarden server. Good thing is, here I can see a more verbose error message pop up:

Exception message: Read error: ssl=0xb40000762e35e188: Failure in SSL library, usually a protocol error error:10000458:SSL routines:OPENSSL_internal:TLSV1_ALERT_UNRECOGNIZED_NAME(external/boringssl/src/ssl/tls_record.cc:594 0xb40000762d015248:0x000000001) 

I didn't find much information about the UNRECOGNIZED_NAME error on the internet, and even looking at the source code hasn't helped a lot. I only found a reference in the extract_sni() function for this error in the file handshake_server.cc. So it seems like an error is happening on the server side of things while the TLS handshake is processed.

Then I used OpenSSL cli to check if everything is set up correctly:

openssl s_client -connect vaultwarden:443 -tls1_2 -tlsextdebug -status CONNECTED(00000003) 001E68D9737F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:ssl/record/rec_layer_s3.c:1605:SSL alert number 112 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 197 bytes Verification: OK --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: PSK identity: None PSK identity hint: None SRP username: None Start Time: 1681121486 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no --- 

Here I get the same error (although in OpenSSL and not BoringSSL) I guess, but it seems like it's working nonetheless.
Now my guess is maybe something is not probably configured in NPM. All my internet searches boiled down to SNI and that it's maybe not setup correctly, but I don't know how to change this, as it seems as long as Nginx is compiled with SNI support, it should work out of the box.

Ultimately I tried out the following command, forcing OpenSSL to use SNI, and no error is propagated.
So I guess this is definitely the right direction, but I'm stuck here, since my DevOps skills are very limited.

openssl s_client -connect vaultwarden:443 -servername vaultwarden -tls1_2 -tlsextdebug -status CONNECTED(00000003) TLS server extension "renegotiation info" (id=65281), len=1 0000 - 00 . TLS server extension "server name" (id=0), len=0 TLS server extension "EC point formats" (id=11), len=4 0000 - 03 00 01 02 .... TLS server extension "session ticket" (id=35), len=0 TLS server extension "extended master secret" (id=23), len=0 depth=1 C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = Local Network, CN = vaultwarden verify return:1 depth=0 C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = vaultwarden, CN = vaultwarden verify return:1 OCSP response: no response sent --- Certificate chain 0 s:C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = vaultwarden, CN = vaultwarden i:C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = Local Network, CN = vaultwarden a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Apr 9 16:49:00 2023 GMT; NotAfter: Apr 8 16:49:00 2024 GMT 1 s:C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = Local Network, CN = vaultwarden i:C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = Local Network, CN = vaultwarden a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Apr 9 16:47:33 2023 GMT; NotAfter: Apr 8 16:47:33 2024 GMT --- Server certificate -----BEGIN CERTIFICATE----- .... -----END CERTIFICATE----- subject=C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = vaultwarden, CN = vaultwarden issuer=C = DE, ST = Baden-Wuerttemberg, L = xxx, O = xxx, OU = Local Network, CN = vaultwarden --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 2713 bytes and written 310 bytes Verification: OK --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: ... Session-ID-ctx: Master-Key: ... PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: 0000 - 89 89 bd a9 65 aa 31 97-5e ba b0 67 ea f5 ae 8c ....e.1.^..g.... 0010 - 2b f8 21 4a 1f 4f f6 6f-f0 1b 12 f8 77 e6 aa da +.!J.O.o....w... 0020 - 78 95 6b ee 72 0d 82 af-a5 fa 03 68 82 41 04 9d x.k.r......h.A.. 0030 - 1f 81 78 2f 6d 23 da 52-46 2e 84 7e 94 d5 4c 4c ..x/m#.RF..~..LL 0040 - 92 63 bd a3 a6 e5 d9 1f-58 51 92 4e cb 4c 14 85 .c......XQ.N.L.. 0050 - cb 5d 2d fa 59 2a 93 32-36 3f a2 31 4a 2e 84 cf .]-.Y*.26?.1J... 0060 - 8f 44 b6 b1 fb 16 d4 66-8c 27 08 36 b3 ba a7 7a .D.....f.'.6...z 0070 - ec 7c 20 fe fa 93 9b 12-bc 46 bc dd 49 61 94 3d .| ......F..Ia.= 0080 - 64 c0 7f df 60 95 45 38-f4 41 84 99 c1 f5 5d 25 d...`.E8.A....]% 0090 - 53 96 e8 26 30 e1 64 b3-7b b8 82 44 23 20 f4 a9 S..&0.d.{..D# .. 00a0 - 33 cd 45 08 73 64 15 cc-3e 3a 03 8c ca 8f 41 ba 3.E.sd..>:....A. 00b0 - f3 14 46 fe df f8 ee 18-55 e2 44 09 4b 24 af d6 ..F.....U.D.K$.. Start Time: 1681124745 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: yes --- closed 

Best regards
vvurzelsepp

[vvurzelsepp]

I got it to work. I ditched NPM and started to configure a custom Nginx docker container.

nginx.conf looks like this:

server { listen 443 ssl; server_name: vaultwarden; ssl_certificate: ssl/vaultwarden.crt; ssl_certificate_key: ssl/vaultwarden.key; location / { proxy_pass <IP-to-actual-vaultwarden-instance>; } } # further server configurations for more services server { .... }