Setting up SSL for remote Emby access

[sweetmslily 5]

Hi folks. So, admittedly this isn't my forte, hardware is, but I'm trying to get our Emby server to run on the secure port since we share our server with a family member in another city. I don't understand the information that the Network page is giving me. 

I have a Porkbun domain for the server that I just bought yesterday. I downloaded their LetsEncrypt certificates, and used the SSL certificate converter in the documentation https://emby.media/support/articles/Secure-Your-Server.html 

Then I downloaded the certification and added it to Emby custom SSL certificate path. I pointed Porkbun DNS at my public IP address.

Under Network in the server, I have set Secure Connection Mode to Required for All Connections. I left the http port at 8096 and switched https to 6786. If I drop my phone off my local network and connect over cellular, specifying the Pokrbun domain and the port 6786, it connects, and streams. But under Dashboard it shows that stream connected over http:/1.1. The dashboard is also showing the server running on HTTP port 8096 instead of the secure port. 

So is the server allowing insecure connections anyway, even though it's set to only accept secure incoming connections? Or is it working and I'm just overthinking it? I'm inclined to say it's working with the secure connection since I wiped my Emby app off my phone, installed it from scratch, pointed it at the domain and secure port, and signed in and used it no problem. But then I don't understand why under Dashboard it shows the server running on HTTP/8096. While I was doing this work, my family member connected and started streaming to their phone, despite not having the new domain/ports, etc. Not sure how they could do that without new the domain/port if Emby is set to only use secure connections. 

I've provided a screenshot for an example. This is what I'm seeing on Dashboard in the server when I stream to my phone on the Emby app over cellular, if I switch to WiFi, the IP address changes but still works fine. I just want to confirm if secure connections are working, or what I need to do now to make them work, having gotten this far. Thanks for the help everyone. 

 

[sweetmslily 5]

Just some additional info. On my laptop, I can resolve the login page at domainname.xyz:6786 but the login page and the main page both read as insecure pages to the browser. Checked in Firefox and Safari. 

So my question now is, why is that happening instead of using the secure connection, when it's sent deny all connections except secure ones?

I'm missing something obvs but I'm stumped. 

[Q-Droid 861]

You can attach a log for review though my guess is your Emby server is not able to open/use your cert store (pfx). The tell-tale sign is your dashboard is showing HTTP only (8096).

But on top of that you seem to have other configuration problems because if it's actually behaving as you describe then WAN port 6786 should not be connecting to 8096. So after you fix the TLS (SSL) setup you might want to review your router port forwarding.

 

 

[sweetmslily 5]

You were right, it was the certificate. I hadn't used TextEdit in over ten years and saved the file with RTF formatting but the right extension. Rookie mistake. Retraced my steps and fixed. I can connect with the secure port number and resolving via browser shows the lock icon. 

 

No issues with the port number, I checked our fibre modem configuration and most ports are open. I was getting confused by being able to sign in over 8096 even though I set remote to secure only but if the secure configuration is broken like it was maybe that setting doesn't do anything. Thanks for pointing me in the right direction!