Skip to content
Register

Héberger un forum phpBB pour 50 seniors

Multilingual by olya 24 replies 2.7K views
olya

Member OP

Always Free

6 #1

Pro tip: this setup runs on Oracle Cloud free tier ARM instance, 4GB RAM, Ampere CPU.

  • Ubuntu 22.04 LTS, nginx + php8.1-fpm
  • MariaDB with slow query log enabled (seniors click twice, duplicate posts happen)
  • Redis for sessions, prevents login loops when they forget passwords
  • Theme: prosilver with font-size bumped to 16px minimum, contrast #000 on #fff

Heads up: cookie consent banners break everything. Seniors click "refuse all" then cant post. Solved by removing non-essential cookies entirely.

Problem now: three members using old iPads on iOS 12 say "site not working." Safari rejects my Lets Encrypt chain. Anyone seen this with older Apple devices?

licensing is a suggestion
Emre10

Member

#2
olya said:
Safari rejects my Lets Encrypt chain

Server down? No, chain bro. Old iOS not trust ISRG Root X1 since september 2021. Bro you need cross-sign from DST Root CA X3. Bro since three year this problem exist. Important: test on real device, emulator lie. Bro you use certbot with --preferred-chain maybe?

MA

Member

4 #3

Sorry for the silly question but if I change the certificate will the forum break for the other members? I am worried about touching anything The seniors are already confused by the new "like" button I added last month.

center807

Member

#4

This is a classic legacy trust anchor issue. In our enterprise-grade facilities we maintain redundant certificate paths for exactly this scenario. N+1 applies to PKI as much as power feeds. The proper solution is dual-path deployment with automated fallback. For pricing on our managed certificate orchestration, contact sales. We operate facilities in undisclosed Tier III locations with redundant feeds.

marccancer

Member

#5
Emre10 said:
You need cross-sign from DST Root CA X3

The DST cross-sign expired in September 2024. This will not help iOS 12 devices regardless of chain preference. Your actual options are limited. Either upgrade the devices or serve an older CA they trust. There is no clean fix for obsolete trust stores. This is the cost of supporting EOL hardware. I would recommend evaluating whether three users justify the security compromise.

-- Marcus

bellaauc

Member

3-2-1 Believer

#6

Before you change anything, did you test your restore? I hope you have 3-2-1 backups for this community. Here is my checklist: daily database dump to two locations, one offsite; test monthly with a fresh VM; document the "like button incident" for future you. For the iPad issue, could you set up a simple read-only mirror on a subdomain with a self-signed cert they manually trust? Not perfect, but keeps them connected. You can check the setup with https://www.ssllabs.com/ssltest/

3-2-1 or you're already dead
MeritBudi

Member

#7

Already try this before lah. The iOS 12 can or not? Actually cannot dong, Apple already block old root. You can buy cheap old cert from reseller can or not? Some still work for legacy. But better you tell the seniors upgrade already, 2025 already lah. Or you give them cheap Android tablet dong, more easy.

RA

Member

#8

I feel bad for the seniors lah

olya

Member OP

Always Free

#9
marccancer said:
The DST cross-sign expired in September 2024

Ah. That explains why --preferred-chain did nothing when I tested. Thank you for the exact date, I was going in circles.

MeritBudi said:
Apple already block old root

So the "buy old cert" path is dead too. Good to know before I wasted money.

I am going to try bellaauc's mirror idea but with a twist: subdomain on Cloudflare Origin CA, not self-signed. Their cert is trusted back to iOS 9 apparently? Need to verify.

licensing is a suggestion
tifiucem

Member

🇹🇷 cheap vps hunter

#10
olya said:
Cloudflare Origin CA

Bro I check for you, Cloudflare Origin CA not work for browser directly lah. That cert only for origin pull, user browser will show invalid. You need Cloudflare proxy ON with their edge cert, then old iOS trust because Cloudflare use different chain.

But careful dong: free plan only 10 rules, and you need orange cloud the A record. I do this for my grandfather blog, work for his iPad 2 iOS 9.3.5 can. Docs: https://www.cloudflare.com

çok ucuz, çok hızlı

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft