Redirect loop when manual adding HTTPS certificate

[miwierzbicki]

Globaleaks installed using Docker-compose.
When adding manually created certificates in order to make HTTPS work, site goes in infinite redirect loop. Steps that I've made:

Generate private key to become local CA (it will be used locally, on separate network):

CANAME=MyOrg-RootCA
# generate aes encrypted private key
openssl genrsa -aes256 -out MyOrg-RootCA.key 4096

Generate CA certificate

openssl req -x509 -new -nodes -key $CANAME.key -sha256 -days 1826 -out $CANAME.crt -subj '/CN=MyOrg Root CA/C=AT/ST=Vienna/L=Vienna/O=MyOrg'

Create certificate for webserver

MYCERT=myserver
openssl req -new -nodes -out $MYCERT.csr -newkey rsa:4096 -keyout $MYCERT.key -subj '/CN=My Firewall/C=AT/ST=Vienna/L=Vienna/O=MyOrg'
# create a v3 ext file for SAN properties
cat > $MYCERT.v3.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
IP.1 = 192.168.11.14 #thats my local machine address 
EOF

Sign the certificate

openssl x509 -req -in $MYCERT.csr -CA $CANAME.crt -CAkey $CANAME.key -CAcreateserial -out $MYCERT.crt -days 730 -sha256 -extfile $MYCERT.v3.ext

And then in GlobaLeaks admin panel:
Uploading the myserver.key private key
Uploading Certificate (myserver.crt).

After saving I cannot reach site anymore and thus, I need to revert backup.

ERR_TOO_MANY_REDIRECTS

As a hostname I have provided local machine IP (192.168.11.14).
Can somebody please help me how to set it up? :) Thanks in advance really!

[evilaliv3]

Hello @miwierzbicki

Are you using some sort of reverse proxy?

GlobaLeaks requires to be exposed directly on ports 80 and 443.
I suspect that the redirect loop may be related to an incorrect configuration of your reverse proxy.

Would you please describe your setup with more detail?

[miwierzbicki]

Hello @evilaliv3! Thanks for feedback.

No, AFAIK there is no reverse proxy. To test it even more, I've created new VM with clean install of Debian 12. (VM is on Proxmox, I have assigned local ip eg. 192.168.11.3, so hostname set in Globaleaks is the same).

Used the same openssl commands as above after installing and configuring Globaleaks. The result is the same - redirect loop. Could somebody be kind enough to show me steps how to achieve that? I would be really grateful.

[miwierzbicki]

I've managed to gain access to admin panel via Tor. This is my current configuration (the machine ip is 192.168.11.109 - there is just clean Debian and globaleaks installed with the installation steps from docs)

When HTTPS option is enabled, i get redirect loop. Now, when it is disabled (as on the image above), and I have ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

What I am trying to achieve is to have locally (on local network/intranet) working Globaleaks with local certificate (because users cannot see browser warning that site is insecure). Could you please give me advise how to make it work? :)

In addition, following troubleshooting from docs, the service does not respond on loopback interface.