Tech support for your technologically-challenged admin

Stop here first to introduce yourself and get clear about rules and expectations! Also contains updates and notes on the forum.
User avatar
Amlux
Site Admin
Posts: 173
Joined: Mon May 25, 2026 11:25 pm
Has thanked: 307 times
Been thanked: 220 times
Contact:

Tech support for your technologically-challenged admin

Post by Amlux »

Hi there. I'm going to use this thread as a dumping ground for running into issues with this forum and my site and associated domains. The good news is that this forum is pretty easy to manage as phpBB makes it simple for n00bs. But when I run into brick walls with adding features to my site, I will add my notes here for troubleshooting if anyone wants to do some charity work as a member of the community and give me pointers or advice. But very little here will be an emergency, so expect the pace of this problem- solving to be relaxed.

Right now, I'm having some trouble getting a script to work on my site that says when I'm live via my Owncast software or not. I believe it has to do with some certification issues which also are likely the result of an error that netdoll got when I went live a while back. satoridepon suggested removing need for a CORS proxy that I was using for an AI-scripted tool I generated talking to ChatGPT, but the tool was ultimately very inconsistent and buggy, so I ditched it. For ideological reasons, it feels right to do it as well. I'm instead using this .php script written for me graciously by drummyfish.

Code: Select all

<!DOCTYPE html>
<html>

<head>
  <link rel="stylesheet" type="text/css" href="https://pantsuprophet.xyz/index/pantsuprophet.css">
</head>

<body>
<?php

  if (strpos("abc","a")) 
    echo "AAA";
  else
    echo "BBB";

  if (strpos("abc","d"))
    echo "CCC";
  else
    echo "DDD";

  //echo strpos("abc","d") ? "CCC" : "DDD";
  //print_r(file_get_contents("https://live.pantsuprophet.xyz/api/status"));
/*
  echo
  str_contains(file_get_contents("https://live.pantsuprophet.xyz/api/status"),"\"online\":true") ?
    "<span class=\"status_on\">online</span>" :
    "<span class=\"status_off\">offline</span>";
 */
?>
</body>
</html>
I'd like to continue with this because it's good to try to get .php files like this set up on my site because it opens up the possibility of a lot of interesting stuff to potentially add to the site (a more dynamic calendar, rotating quotes/images, etc.). This works with other Owncast streams but not my own, and it almost certainly has to do with the certification issue. When I perform a "curl https://live.pantsuprophet.xyz/api/status" I get this error:

Code: Select all

curl: (60) SSL: no alternative certificate subject name matches target host name 'live.pantsuprophet.xyz'
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
So there's some issue with my certification but not with others, which explains why the .php file has trouble picking up any info from it. When I look at my /etc/nginx/sites-available/owncast file, it looks like this:

Code: Select all

server {
    server_name live.pantsuprophet.xyz;  # Replace

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/live.pantsuprophet.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/live.pantsuprophet.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = live.pantsuprophet.xyz) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name live.pantsuprophet.xyz;
    return 404; # managed by Certbot


}
If anyone knows more about this than me, please let me know what I could do to help.

Until then, I'll be posting here manually when I go live or possibly look for some third-party software/script that does it for me. I think I tend to get more viewers when I do manually post about it anyway, and it takes me like 2 seconds. So we'll do it old-fashioned for now. :waha:
---------------------------------------------------------------
Please message me with any comments or concerns, either on this forum or by email: pantsuprophet@disroot.org
User avatar
drummyfish
Posts: 103
Joined: Wed May 27, 2026 1:10 pm
Location: Moravia (Czech Republic)
Has thanked: 167 times
Been thanked: 170 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by drummyfish »

To summarize the issue as I understand it:

PHP on Amluxe's server is unable to retrive the stream status with

Code: Select all

file_get_contents("https://live.pantsuprophet.xyz/api/status");
due to an error that states "insecure" connection. The same function WORKS with other Owncast streams (we tried). Amlux is also unable to just curl the API from shell with

Code: Select all

curl https://live.pantsuprophet.xyz/api/status
Curl gives same kind of "insecure connection" error shown in OP.

Weird thing is that both of these (PHP's file_get_contents and curl) WORK on all my computers, it's just the Amlux server that can't do it. Besides this people are obviously able to watch his streams without their browsers complaining about insecure connections.

So the issue therefore seems to be in Amlux server's PHP (and curl) certificate authority database (which they seem to share), i.e. my computers see Amluxe's stream URL as safe because his certificate is signed by an authority that my computers know, but Amluxe's server doesn't seem to have the same CA database or something. Now this is completely outside my field and area of interest, so I have no idea what's actually going on, which is why this thread has been made. Maybe the solution is something trivial like updating some database with a single command, I don't know.

I.e. we need to solve: make Amluxe's server accept his certificate as valid.

---------------------------------

By the way Amlux now I am wondering if this is only affecting the "live.pantsuprophet.xyz" subdomain. Are you able to do this from your server?

Code: Select all

curl https://pantsuprophet.xyz/index.html
love everyone, help selflessly
User avatar
Amlux
Site Admin
Posts: 173
Joined: Mon May 25, 2026 11:25 pm
Has thanked: 307 times
Been thanked: 220 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by Amlux »

Not sure if this is related but I was looking around and noticed something. I did a bit of poking at my /etc/nginx/sites-available file for live.pantsuprophet.xyz and noticed that it reads as follows:

Code: Select all

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/live.pantsuprophet.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/live.pantsuprophet.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
While my files in the same directory for pantsuprophet.xyz and forums.pantsuprophet.xyz look like this, respectively:

Code: Select all

    listten [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/forums.pantsuprophet.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/forums.pantsuprophet.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    

Code: Select all

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/forums.pantsuprophet.xyz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/forums.pantsuprophet.xyz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
That is, both of them contain a line which says something like listen [::]:443 ssl, unlike the live.pantsuprophet.xyz file, which only has listen 443 ssl.

Also, I noticed that both of these use an ssl certificate which reads as forums.pantsuprophet.xyz while this one uses live.pantsuprophet.xyz. I might have messed something up trying to set up Certbot certifications? It's confusing! Anyway, I'll have a look at Certbot settings the next time I have the freedom to do this. I'm going to be busy with friends for a good chunk of today, hosting the CyTube party tomorrow (please join!), and then I'll be busy with IRL duties from June 7th-11th (still checking in on the site and forum every day of course, just without as much time as usual).

Thanks to drummy for his help and anyone else reading this for advice and support ^^
---------------------------------------------------------------
Please message me with any comments or concerns, either on this forum or by email: pantsuprophet@disroot.org
User avatar
satoridepon
Posts: 29
Joined: Fri May 29, 2026 11:09 pm
Has thanked: 79 times
Been thanked: 60 times

Re: Tech support for your technologically-challenged admin

Post by satoridepon »

Try curling http://localhost:8080/api/status on the server, there shouldn't be no need to use the domain.
:waha:
User avatar
drummyfish
Posts: 103
Joined: Wed May 27, 2026 1:10 pm
Location: Moravia (Czech Republic)
Has thanked: 167 times
Been thanked: 170 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by drummyfish »

satoridepon wrote: Fri Jun 05, 2026 12:15 pm
Try curling http://localhost:8080/api/status on the server, there shouldn't be no need to use the domain.
Actual genius suggestion that could literally solve this, thank you.

Still would be cool to find out and fix the core issue to avoid future problems. I noticed running these:

https://www.sslshopper.com/ssl-checker. ... rophet.xyz
https://www.sslshopper.com/ssl-checker. ... rophet.xyz

that they both seem to be fine, but with the first (pantsuprophet.xyz) it gives alternatives names (SANs) forums.pantsuprophet.xyz, muc.pantsuprophet.xyz, pantsuprophet.xyz, proxy.pantsuprophet.xyz, share.pantsuprophet.xyz, videos.pantsuprophet.xyz, whereas the second (live.pantsuprophet.xyz) gives alternative names only live.pantsuprophet.xyz. I don't even know what it means but it's SUS that the "live" subdomain doesn't show up in the first alternative names.
love everyone, help selflessly
User avatar
Amlux
Site Admin
Posts: 173
Joined: Mon May 25, 2026 11:25 pm
Has thanked: 307 times
Been thanked: 220 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by Amlux »

Hi there forum people. If anyone knows anything about certificate issues, I'm still working on issues with certifications. For now, I've removed the contents of live.pantsuprophet.xyz until I can get the URL certified well. When I looked at the certifications I have for certbot, I noticed that I had a duplicate certification for this forum. Namely, there were two certifications named:

forums.pantsuprophet.xyz
forums.pantsuprophet.xyz-0001

I ran the command "certbot delete --cert-name forums.pantsuprophet.xyz-0001" as seems to be the recommended way to deal with this and that worked fine. All associated files were deleted.

However, when I attempt to reload nginx or otherwise use certbot to manage certifications, I get the following error:

Code: Select all

Jun 23 04:18:55 pantsuprophet nginx[2159769]: nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
That is, nginx.service tries to still load the deleted certificate. I don't know what files to edit to fix this, if any. For the record, my nginx.conf looks like this:

Code: Select all

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}
If anyone has any advice before I start asking LLMs, I would be appreciative!
---------------------------------------------------------------
Please message me with any comments or concerns, either on this forum or by email: pantsuprophet@disroot.org
User avatar
vulonkaaz
Posts: 35
Joined: Thu Jun 04, 2026 12:58 pm
Location: Luxembourg
Has thanked: 6 times
Been thanked: 65 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by vulonkaaz »

I think last time I had this problem I just deleted all the certificates and generated them again
Image
User avatar
vulonkaaz
Posts: 35
Joined: Thu Jun 04, 2026 12:58 pm
Location: Luxembourg
Has thanked: 6 times
Been thanked: 65 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by vulonkaaz »

Amlux wrote: Tue Jun 23, 2026 5:09 pm
However, when I attempt to reload nginx or otherwise use certbot to manage certifications, I get the following error:

Code: Select all

Jun 23 04:18:55 pantsuprophet nginx[2159769]: nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
That is, nginx.service tries to still load the deleted certificate. I don't know what files to edit to fix this, if any. For the record, my nginx.conf looks like this:

Code: Select all

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}
If anyone has any advice before I start asking LLMs, I would be appreciative!
nginx is still trying to load the -0001 certificate you have to modify the config files, probably the one in sites-available that handle the live. subdomain
Image
User avatar
Amlux
Site Admin
Posts: 173
Joined: Mon May 25, 2026 11:25 pm
Has thanked: 307 times
Been thanked: 220 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by Amlux »

Lol wtf, not sure what happened to my post. Anyway I'll try it, thanks.
---------------------------------------------------------------
Please message me with any comments or concerns, either on this forum or by email: pantsuprophet@disroot.org
User avatar
Amlux
Site Admin
Posts: 173
Joined: Mon May 25, 2026 11:25 pm
Has thanked: 307 times
Been thanked: 220 times
Contact:

Re: Tech support for your technologically-challenged admin

Post by Amlux »

vulonkaaz wrote: Tue Jun 23, 2026 5:22 pm
Amlux wrote: Tue Jun 23, 2026 5:09 pm
However, when I attempt to reload nginx or otherwise use certbot to manage certifications, I get the following error:

Code: Select all

Jun 23 04:18:55 pantsuprophet nginx[2159769]: nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
That is, nginx.service tries to still load the deleted certificate. I don't know what files to edit to fix this, if any. For the record, my nginx.conf looks like this:

Code: Select all

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	##
	# Basic Settings
	##

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	server_tokens off;

	# server_names_hash_bucket_size 64;
	# server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	##
	# SSL Settings
	##

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

}


#mail {
#	# See sample authentication script at:
#	# http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#	# auth_http localhost/auth.php;
#	# pop3_capabilities "TOP" "USER";
#	# imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#	server {
#		listen     localhost:110;
#		protocol   pop3;
#		proxy      on;
#	}
#
#	server {
#		listen     localhost:143;
#		protocol   imap;
#		proxy      on;
#	}
#}
If anyone has any advice before I start asking LLMs, I would be appreciative!
nginx is still trying to load the -0001 certificate you have to modify the config files, probably the one in sites-available that handle the live. subdomain
Not sure what to do here as I have no .conf files related to the live. subdomain anymore anywhere either in my /etc/nginx/sites-available (or sites-enabled) nor in my /etc/letsencrypt folder (where certbot files are). It seems that something in nginx is still looking for this file despite it being missing, but I dunno how to change that.

For the record, I've managed to remove other certs with certbot without this issue. For example, I had individual certs for several other subdomains for stuff like XMPP and an aborted attempt to set up a PeerTube instance and was able to remove those certifications. Right now I currently have two certs:

forums.pantsuprophet.xyz (controls domains pantsuprophet.xyz as well as forums., muc., proxy., share., videos. subdomains)
pantsuprophet.xyz (controls pantsuprophet.xyz only)

I used to have separate certs for muc., proxy., share., and videos., and removing those hasn't caused the same issues with certbot. Regardless, nginx -t resuls in:

Code: Select all

nginx: [emerg] cannot load certificate "/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/letsencrypt/live/forums.pantsuprophet.xyz-0001/fullchain.pem','r') error:2006D080:BIO routines:BIO_new_file:no such file)
nginx: configuration file /etc/nginx/nginx.conf test failed
So yeah, any feedback before I hit up the LLMs would be appreciated. Thanks again for the help!
---------------------------------------------------------------
Please message me with any comments or concerns, either on this forum or by email: pantsuprophet@disroot.org
Post Reply