Héberger un forum phpBB pour 50 seniors

olya · 2025-04-02T14:11:58+00:00

Pro tip: this setup runs on Oracle Cloud free tier ARM instance, 4GB RAM, Ampere CPU. [list][]Ubuntu 22.04 LTS, nginx + php8.1-fpm []MariaDB with slow query log enabled (seniors click twice, duplicate...

marccancer

Member

Joined:: Nov 2024
Posts:: 12
From:: Lyon, France

1y ago

8 #11

olya said:

Cloudflare Origin CA

No. Origin CA certificates are not served to end users. They terminate at Cloudflare's edge. The user-facing certificate comes from Cloudflare's own issuance, which uses a modern chain that iOS 12 may or may not trust depending on patch level.

The actual question is whether these iPads have the 2019 security update that added ISRG Root X1. If they do, your existing Let's Encrypt works. If they do not, Cloudflare's default chain also fails because they phased out DST cross-sign around the same time.

Check Settings > General > About > Certificate Trust Settings on one device. Look for ISRG Root X1 manually enabled or disabled.

HO

hostspau

Member

Joined:: Jul 2024
Posts:: 9
From:: New York, USA

1y ago

#12

I've dealt with this in New York for a nonprofit with similar demographics. We ended up buying three refurbished iPad Air 2 units for $89 each, wiped the old ones with Apple Configurator, and moved on. Total cost under $300, no ongoing certificate hackery, seniors got devices that actually run current iOS.

Sometimes the engineering solution is "spend money." I know this is heresy on a free-tier forum.

MeritBudi

Member

Joined:: Jun 2024
Posts:: 108
From:: Bandung, Indonesia

1y ago · edited

#13

RahulLite said:

I feel bad for the seniors lah

Me also lah. But 2025 already, iOS 12 no security patch since 2019. These iPad can kena exploit easy easy. Better tell them cannot use, or buy cheap Android like I say. Xiaomi Redmi Pad SE got 11 inch, big font, cheap cheap.

MA

mahdilime

Member

Joined:: Jun 2024
Posts:: 7

1y ago · edited

#14

The "like button incident" was when I added a thumbs-up plugin and half the seniors thought it meant "call an ambulance." Three days of panic emails. I am NOT touching certificates without a rollback plan.

bellaauc

Member

3-2-1 Believer

Joined:: Jun 2024
Posts:: 190
From:: Auckland, NZ

1y ago · edited

#15

mahdilime said:

I am NOT touching certificates without a rollback plan

This is the correct instinct. Snapshot your VM before any change. Oracle Cloud has free boot volume snapshots, use them.

For the actual problem: has anyone confirmed these iPads are actually failing on the LE chain, or could it be the TLS version? nginx default might negotiate TLS 1.3 only, and old Safari tops out at 1.2. Check your ssl_protocols line.

3-2-1 or you're already dead

olya

Member OP

Always Free

Joined:: Jun 2024
Posts:: 159
From:: Warsaw, PL

1y ago · edited

#16

bellaauc said:

Check your ssl_protocols line

Oh. OH. You beautiful person. I had ssl_protocols TLSv1.3; from some hardening guide. Commented that out, added TLSv1.2, tested on the oldest iPad via remote session with the member's grandson.

It was not the certificate. It was TLS.

I feel stupid but also relieved. Thank you.

licensing is a suggestion

Emre10

Member

Joined:: Jul 2024
Posts:: 67
From:: Istanbul, Turkey

1y ago · edited

5 #17

olya said:

It was not the certificate. It was TLS.

Bro I also feel stupid. I jump to chain problem because common, but should ask protocol first. Basic troubleshooting, I forget. Emre10 ashamed.

But happy for you and seniors. Now they can click "like" without ambulance.

AS

astro18

Member

Joined:: Sep 2024
Posts:: 5
From:: Oslo, Norway

1y ago · edited

#18

For future reference, Mozilla's SSL Configuration Generator has an "Intermediate" profile that balances security with compatibility back to Firefox 27, Chrome 30, IE 11, etc. I use the "Old" profile only when specifically supporting Android 4.0 or Windows XP. For iOS 12, Intermediate works fine.

Link: ssl-config.mozilla.org

Also consider OCSP stapling, reduces connection latency for those on rural connections.

ana_mad

Member

Joined:: Jun 2024
Posts:: 298
From:: Madrid, ES

1y ago · edited

#19

olya said:

Oracle Cloud free tier ARM instance

How is the network performance for you? I tried OCI Ampere in Frankfurt and got inconsistent routing to Spain, sometimes via London with +40ms for no reason. Moved the forum to a Hetzner ARM in Falkenstein, much more stable to Madrid, and the price is still negligible for a 2GB instance.

Not free, but €3.79/month for peace of mind.

swimming upstream since 2019 🐟

olya

Member OP

Always Free

Joined:: Jun 2024
Posts:: 159
From:: Warsaw, PL

1y ago

#20

ana_mad said:

How is the network performance for you?

Warsaw to Warsaw is fine, but I have heard the Frankfurt routing lottery stories. My seniors are all in Poland so it does not matter. For your Spain users Hetzner makes sense — https://www.hetzner.com/cloud.

I should document this TLS thing in the forum wiki. "If you followed a 2023 hardening guide, check your protocols."

licensing is a suggestion

Post a reply