Connecting through SSL

[daetsch]

I am facing issues connecting with ssl with the new Piwigo-Android-App. I tried every beta so far and still have the same problem. Here are some informations:

I have a Piwigo-Instance (latest) on my internal network which is available, lets say through http://piwigo.test.lan/piwigo/
Connection from a browser -> works!
Connection from Piwigo-Android-App -> works!

The same instance is also available from external with a Reverse-Proxy (HA-Proxy with SSL-Offloading) and an official Lets Encrypt-Certificate. Lets say: https://test.external.com/piwigo/
Connection with browser -> works!
Connection with Piwigo-Android-App -> Error: "Login Fail Dio: Invalid url"

Anybody with the same problem?
Thanks for helping out and by the way: great app so far and very looking forward seeing it developed!

[remi-martin]

Hi, thanks for the feedback.

A new version of Piwigo NG is about to be released (still beta). I'll change the "Login Fail Dio: Invalid url" error to get more information about the problem

[daetsch]

Thanks martin, I did some more research and saw on HA-Proxy that there is a "SSL handshake failure".

I use following ssl-options on HA-Proxy: ssl-min-ver TLSv1.2 no-tls-tickets ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384

[DWDixik]

Hi, may be i have some issue.
I have local LAN server 12.2.0 with self signed ssl.

• connection from smatphone browser - ok.
• connection from you app - Error: "Login Fail Dio: Invalid url."
• connection from alt app - error.

nginx error log is empty :-/
I have been following you app since May 2021, an error since then.

thx for any help or advice

[flashmaddison]

Got the same issue and circumstances here with the new NG app -- web and old android app work fine, can't connect to my self-hosted site through Piwigo NG - I get the Error: "Login Fail Dio: Invalid url." message.

[remi-martin]

Hi, got it.

We will work on this along with the other "Login" issues.

[remi-martin]

Got the same issue and circumstances here with the new NG app -- web and old android app work fine, can't connect to my self-hosted site through Piwigo NG - I get the Error: "Login Fail Dio: Invalid url." message.

Hello, can you give me your Piwigo url so I can figure out the problem ?

[flashmaddison]

Got the same issue and circumstances here with the new NG app -- web and old android app work fine, can't connect to my self-hosted site through Piwigo NG - I get the Error: "Login Fail Dio: Invalid url." message.

Hello, can you give me your Piwigo url so I can figure out the problem ?

Hi, thanks for getting back to me! It's working now, and I'm not sure why :)

I suspect it might be the way the URL field behaved when I entered it and a space character was auto-inserted, android keyboard input or the way the field validation works perhaps?

[remi-martin]

Spaces at the end of the field are removed before the request is sent...
But good to know that it works well now 👍

[marcusbirkin]

@daetsch It's likely your reverse proxy is misconfigured.
I've just had exactly the same issue, and this was resolved by having the reverse proxy correctly issue the intermediate CA as part of the certificate chain.

While I had no issues connecting with a browser, this application (and others) would fail to connect.
The reason being that a browser will generally download the intermediate from elsewhere (AIA fetching) or use a local cache. However this application requires that the web server (or reverse proxy) directly issues the full chain (excluding root).

Using this scanner helped me pinpoint the issue: https://www.ssllabs.com/ssltest/index.html

[daetsch]

@marcusbirkin Thanks for your input. Actually connecting through SSL works without doing anything on HA-Proxy now. Not sure if an update of Piwigo-Android-App or an update from HA-Proxy meanwhile solved the problem. SSL-Scanner says everything is good.

But then I couldn't see any pictures, only white boxes, because frontend is :443 and backend is:80. This is related to
Piwigo/Piwigo#982 (comment) Editing local/config/config.inc.php based on @josmartin comment solved this issue.

[hardwareadictos]

Just to complement #114 ... Can someone give me the commands you used to create your certs with openssl? Maybe we have two different issues but firstly i have to confirm that i am creating my certs correctly. Thakns in advance :)

[remi-martin]

I saw this on Github. I'll try to implement it, it might solve SSL issues.
https over self-signed certificate

[remi-martin]

I talked with the iOS team, it seems they had the same issue and they fixed it by asking to the user if he trusts the domain and it's certificate. Then, the domain is stored and the permission will never be asked again.

I'll try to implement it on Piwigo NG.
(note: uninstalling the app will remove all accepted certs, along with other app settings and preferences)

[remi-martin]

Added an advanced login settings page to manually allow invalid certificates in 2.1.0, comming soon on Play Store.

[remi-martin]

This should be fixed now :

• Make sure you have Piwigo NG 2.1.0 and above.
• From login screen, press Advanced settings.
• Activate Enable SSL.

If you still have with SSL and Piwigo NG, please create a new issue.