Deploying WebPage online Using A record.

[Pieter3033]

Hi @lovasoa, hope you are doing well.

I would like to deploy my SQLPage website to HTTPS for testing.

I have uploaded my SQLPage folder to server X and our domain managers have created an A record on the domain, and pointed the A record to server X.

Let's use the below as an example:

A record name: page.domainname.co.za
A record port: 1234
A record point to: Server X

sqlpage.json content:

{
  "database_url": "mssql://user:password@ip/database",
  "https_domain": "page.domainname.co.za",
  "port": "1234"
}

When I run SQLPage.exe I get this error:

We have confirmed with our domain managers that there is no conflict with the firewall, and that the A record is setup properly.

The reason we are using this method instead of pointing the domain to server X is because we have multiple A records running at different locations.

Note: The location of the SQLPage folder and the database is not on the same server, we are running the SQLPage.exe on a Windows server.

[lovasoa]

Hi !
There is a few potential causes I see here:

• What is the A record port you are mentioning ? DNS A records don't include a port number are you refering to a firewall configuration ?
• "port": 1234 in the configuration will be ignored. HTTPS traffic must occur over port 443, and sqlpage will always listen on port 443 when serving https traffic. Certificate providers don't sign certificates for signing traffic on other ports.
• your screenshot mentions database_url_ip. Is this a mistake ? The ip in the dns record must be the one of the server where sqlpage is running, not the one of the server where the database is running.
• the error message mentions not being able to access the ip. Maybe you should check with your network administrators that port 443 of the server where sqlpage is running (and which your A record points to) is accessible from the public internet, with no firewall blocking it.

[lovasoa]

Also, if you are trying things and not sure yet it will work, you can temporarily set "https_acme_directory_url" : "https://acme-staging-v02.api.letsencrypt.org/directory" in the configuration. This will generate a certificate that is not accepted by browsers, but is better for running your tests, because it will prevent you from getting banned from requesting a certificate because you are making too many failed attempts.

[Pieter3033]

What is the A record port you are mentioning ? DNS A records don't include a port number are you refering to a firewall configuration ?

I Believe this is referring to firewall configuration, apologies learning as I go.

We just made contact with our network administrators, they will make sure port 443 is accessible from the public internet, with no firewall blockage.

Thanks for the advice for the testing xD, I was struggling the whole day yesterday, only getting 5 attempts per hour.

[Pieter3033]

your screenshot mentions database_url_ip. Is this a mistake ? The ip in the dns record must be the one of the server where sqlpage is running, not the one of the server where the database is running.

I Just double checked, this is the database_url_ip, we have confirmed with our network administrators as well, they did point the DNS record to the IP where SQLPage is running.

[lovasoa]

There's something that's not right, then. How could the certificate provider even know your database's ip if you are giving it a domain name that points to your sqlpage server ip ?

Here are the two things I would do to pinpoint where the problem is coming from.

• First, run dig page.domainname.co.za:

  • ❯ dig page.domainname.co.za
    
     ; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> page.domainname.co.za
     ;; global options: +cmd
     ;; Got answer:
     ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30934
     ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
     
     ;; OPT PSEUDOSECTION:
     ; EDNS: version: 0, flags:; udp: 65494
     ;; QUESTION SECTION:
     ;page.domainname.co.za.		IN	A
     
     ;; ANSWER SECTION:
     page.domainname.co.za.	3600	IN	A	103.224.182.245
     
     ;; Query time: 728 msec
     ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
     ;; WHEN: Fri Dec 01 12:10:15 CET 2023
     ;; MSG SIZE  rcvd: 66
    

• and confirm the ip returned (103.224.182.245 here) is the one of the machine sqlpage is running on:

  • ❯ ifconfig
     [...]
     eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
      inet 103.224.182.245  netmask 255.255.255.255  broadcast 0.0.0.0
    

  • the ip should be the same. If they don't match, ask to have the A record changed.
• Then, confirm you can access the machine from the outside. On the server run anything on port 443. For instance, a simple netcat :

  • sudo netcat -l 443
    

  • then, from your browser's smartphone (to be sure you are outside of the enterprise network), load https://103.224.182.245 (with the ip from the previous step)
  • the page shouldn't load from your smartphone, but you should see something appear on the terminal where netcat is running:

    > sudo netcat -l 443
    zvEe���rT��B�e��PuYe��K�T�bH� ����)F�5�
    *��]�N<�2H��"�+�/̨̩�,�0�                 �#��
    �	����/5
                  �
    
    
    #
     hhttp/1.1"
    3ki _Oj��+���F�E�+���&M����a5~AŪ�9v15᫙��T�Ʒ�{E��5����7�`�ҵ.=u��g�8����N9¶
    � �4WhSj�v����e}s������w\�&���͐��a^��$�6=�1��
    ��y�����%y�}�si�x���M
    

  • this confirms you can access port 443 of the machine from the outside. If you can't (if you don't see the garbled text appear in the terminal when you load the page), then tell the network administrators that something blocks access to port 443 on your server.

[Pieter3033]

Hi @lovasoa, I apologize for disturbing you with this matter again.
I am not sure what I am doing wrong but if you won't mind assisting me.

Note: We have confirmed with our network administrators, port 443 is open for https traffic.
We are running SQLPage on a windows server.

So I have confirmed the following:
database_url_ip refers to our gateway, which is the one our database uses to allow connection from outside the internal network.

Dns_name: page.domainname.co.za
gateway: 197.xxx.xxx.xx
internal_server(SQLPage is running here): 192.168.xxx.xxx

nslookup page.domainname.co.za:

• My manager asked me to ask the following question:
  -We have our own SSL certificate, will this be a problem.

• Here is my configuration file, am I missing something?

{
  "database_url": "mssql://user:pass@ip/DB",
  "https_domain": "page.domainname.co.za",
  "https_acme_directory_url" : "https://acme-staging-v02.api.letsencrypt.org/directory"
}

Errors generated:
[2023-12-05i-11:56:06.170Z ERROR sqlpage::webserver::https] ACME configuration error: Order(Acme(HttpRequest(Non2xxStatus { status_code: 400, body: "{\n \"type\": \"urn:ietf:params:acme:error:malformed\",\n \"detail\": \"Unable to upda - challenge :: authorization must be pending\",\n \"status\": 400\n}" I)))

[2023-12-05T11:56:31.046Z ERROR sqlpage::webserver::https] ACME configuration error: Order(BadAuth(Auth { status: Invalid, identifier: Dns("page.domainname.co.za "), challenges: [Challenge { typ: IlsAlpn01, url: "https://acme-v02.api.letsencr pt.org/acme/chall-v3/290629717846/DQ-eXg", token: "kCvSdqZe9W8OxgVKICRVJXRyBO2y6oYmYSL3aAIY20o", error: Some(Problem { typ: Some("urn:ietf:params:acme:error:connection"), detail: Some("197.xxx.xxx.xx: Timeout during connect (likely fire all problem)") }) }] 1))

[lovasoa]

Look at my message above. You need to put something to listen on port 443 on the server, and see if it receives the request.

[Pieter3033]

[lovasoa]

Looks like you have something listening on port 443 on that server. If it doesn't receive the requests you make from your smartphone, then you have something in between blocking the request. You should ask your network administrator how to set this up; this does not seem to be a SQLPage problem.

[Pieter3033]

Hi @lovasoa,

It's working now. I honestly don't know how, but it's working.

We had a meeting with out firewall administrators and network administrators this morning, they informed us that it the ACME servers that closes our connection.

I then made contact on ACME community for assistance and according to them there is still a problem with port 443.

And then somewhere in between it started working. So I am not sure where the problem was anymore but it is fixed.

Thank you for your patience and assistance.

Regards

[lovasoa]

Great news, congrats @Pieter3033 !