Pydio cells on Windows Server 2016 with IIS Reverse Proxy

Pydio Cells
1

Hello Forum,

i’am running a Windows Server 2016 Machine with with task that rely on an IIS as Webserver.
Now trying to install pydio cells and connect it via an IIS ReverseProxy on https.

cells is accessible without TLS (SSL offload at the IIS Reverse Proxy)
but when i switch on TLS with self sign certificates i get a 502.3 error from the IIS Proxy…
(without SSL offload)

Is ther anybody out there who uses pydio cells behind an IIS Proxy?!

General information:
CELLS_BIND=myserver:8084
CELLS_EXTERNAL=https://data.mydomain.cloud
Certificates on Proxy wit Certify the Web are correkt for all subdomains -> no errors
IIS default Reverseproxy Rule pointing to https://myserver:8084

Thank you in advance
Luke

2

Hi,

I guess you are going to config as follow:
[cells]:8084: <=== (selfsigned cert) tls === [IIS]:443 <===tls===
and you got: HTTP Error 502.3 - Bad Gateway A security error occurred

Did you ignore “certificate check” in the config of reverse proxy of IIS ?

3

Oh,
thanks for reply…
Forgot that Detail. I’ve add the selfsigned cert with ‘mkcert.exe’ to the trusted root.

local on the server open https://myserver:8084 let me stuck at the pydio loading screen (correct with the external bind at https://data.mydomain.cloud) but with valid certificate

i’ve also try to diable the check:
WINHTTP_OPTION_SECURITY_FLAGS ARR: Support Added for WINHTTP_OPTION_SECURITY_FLAGS | Microsoft Docs

with Value 0 an 0x00000100 to disable the check -> no success?!

any further information needed?

Thanks
Luke

4

Hello out there,

has no one a walk through to get cells working with the IIS Reverse Proxy?!
Feel free to ask for more details!!!

Luke

5

Finally the Key works:
“HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\IIS Extensions\Application Request Routing\Parameters\WINHTTP_OPTION_SECURITY_FLAGS=0x00000100”

restart the Server inadvertently solved the problem…
Restarting only the IIS Service was insufficient!

That brings up the next problem:
Cells Sync / gRPC Config

Login no Problem!
Add Task → List Workspaces → “Server closed the stream without sending trailers”

Any hints for me?
Luke

1 Like
6

thanks for the awesome information.