SSL made easier with a reverse proxy

[jachin99 88]

I never setup a client that tells Google DNS what my public IP is because I always thought that was part of the DDNS service provided with google domains.  The only section I have configured under google domains is under the Synthetic Records/Dynamic DNS DDNS section.  The only thing I am able to fill out for that section is my domain name, which I am using my TLD.  Even after reading the instructions on google's site, the only thing I got out of it was to put an @ symbol in the DDNS box.  Thats all I did on the google side.  I'm getting errors in my Caddy log about being unable to deactivate or something similar.  I post the whole log for caddy if I have to.  

 

Also, the cert registration problem, and my uncertainty about whether or not I correctly setup my domain name are two entirely separate issues, and one shouldn't effect the other, or do they tie into each other?  It would seem like I should get my domain setup right, and then configure caddy but IDK because this is my first time doing this.  Thanks.  

[muzicman0 84]

They do tie together. The verification (to get the cert) had to connect using the domain name. That's how they verify you are who you say you are.

[jachin99 88]

How would I setup a client that tells Google dns what my public IP is?

[muzicman0 84]

Like I said, I used my NAS or my Router to do this.  Outside of that, I am not sure.  I know Google uses the DynDNS2 protocal, so I would google search that and see if you can find info.  Or perhaps someone on here may know of a client app that works.

[jachin99 88]

Thanks for the pointers.  I'm sure I'll get it figured out.  

[muzicman0 84]

I found this one, but don't know much about it.  looks like it would work though.

 

http://www.randomnoun.com/wp/2013/08/19/a-dynamic-dns-client-for-windows/

 

EDIT: I Found this also, which should give you everything you need:  http://www.netinstructions.com/how-to-setup-dynamic-dns-for-home-computer-or-server/

Edited March 15, 2020 by muzicman0

[jachin99 88]

Like I said, I used my NAS or my Router to do this.  Outside of that, I am not sure.  I know Google uses the DynDNS2 protocal, so I would google search that and see if you can find info.  Or perhaps someone on here may know of a client app that works.

It looks like my router has a DDNS client also.  My router's DDNS configuration options are asking for a URL, username, password, and hosts.  When I configure my router's DDNS client, I'm guessing I use domains.google.com for url, and my emby server's IP for hosts?  Thanks.  I'm guessing I can use either my router, or a third party program installed directly on my Emby server?

 

Edit: looking through some of those articles, it looks like its the job of my router or DDNS client to tell my domain provider (Google) that my IP address has changed, and google's DNS records need to be updated to reflect that change?

Edited March 16, 2020 by jachin99

[muzicman0 84]

I have:

 

Service: Custom

HostName: my DNS Name, which is xxxxxxxx.xxxxxxxx.com (IE: stream.muzicman0.com   <-that's not my real hostname, just an example)

Login: username provided by Google DNS (you have to expand the DDNS entry to see this in googles DNS settings)

Password: password provided by Google DNS (you have to expand the DDNS entry to see this in googles DNS settings)

Protocol: Dyndns2

Server: domains.google.com

[jachin99 88]

It looks like my settings are pretty close to yours given we have different routers.  When my DDNS client is setup correctly should my google domains dashboard show my public IP address under DDNS & Data?  It doesn't right now, and just shows 0.0.0.0.  Thanks again for all of your help.  

[muzicman0 84]

Yes, it should almost right away show your public IP address there.

[jachin99 88]

I asked for some help on peplinks forum so hopefully they can help out also.

[jachin99 88]

Alright so a little update here. Caddy actually has a ddns client plugin available but I wasn't too sure about how to configure it. I chose to use ddclient for windows instead. I installed that, filled out all of the boxes correctly during setup but it still didn't work. I started checking my config file for ddclient and I noticed that it was a little different from how the Google help page recommended it should be. I configured it to match Google's recommendations and now I can see my public IP under Google domains dashboard. So that's setup correctly now from the looka of it.

[jachin99 88]

I took down the reverse proxy and used zero ask to generate my cert. At this point my ddns seems to be working, and emby has a valid cert. For whatever reason I still can't get to my server from the wan but I also don't have any port forwarding happening at the moment. After reading through the SSL Made easy tutorial I didn't see any mention of port forwarding. I have upnp disabled on my router also so maybe I do need to forward a port wit or without the proxy

 

Also my server looks to be unreachable from the lan at the moment.

Edited March 16, 2020 by jachin99

[AbnrangerZay 1]

Hey all, so I have this setup, just need to get into this stupid xfinity router to see if I can manually setup the port forwarding for 80 and 443 to my Emby server. When I try doing it thru the app it doesn't work. Anyhow, as for dynamic dns setup on google domains, do I need to setup anything anywhere else for it to resolve? Again, I have the Xfinity router, so not sure I need to configure anything in it like I would do with a ddns client. I see some mention on here that their router handles that, but I assume those are third party routers.

[Carlo 4560]

Hi, let us know how you make out with the port forwarding.

This KB article might help you as well:
https://emby.media/support/articles/Connectivity.html

If you get stuck let us know and we can remotely help you.

Edited November 6, 2025 by GrimReaper
KB article link updated

[Mookdog 90]

Hey guys

Does anyone have an idea on how to change caddy from Lets Encrypt to Zerossl ?

I notice Let Encrypts certificates do not work on my daughters LG TV

Mook

[seanbuff 1313]

7 hours ago, Mookdog said:

Does anyone have an idea on how to change caddy from Lets Encrypt to Zerossl ?

I believe someone just posted instructions in the other Caddy thread
https://emby.media/community/index.php?/topic/84777-caddy-v2-update-and-warning/&do=findComment&comment=1080713

 

[AbnrangerZay 1]

On 10/6/2021 at 12:04 PM, cayars said:

Hi, let us know how you make out with the port forwarding.

This KB article might help you as well:
https://support.emby.media/a/solutions/articles/44002137137

If you get stuck let us know and we can remotely help you.

So, after much fussing with Xfinity and three routers later, today I finally got the port forwarding to work. Anyone that is on Xfinity, if you have that new gateway, the white one, there is a bug that will not allow port forwarding to configure. You need the black one, the version 6. However, even now with the port forwarding working, I am still not able to connect to my Emby from outside. The service is running on my Emby server, I have the dynamic dns set up in my Google domains as you see in my screenshot. I setup the network options in Emby as instructed with external domain configured to point to the url for my domain and that certs are handled by reverse proxy. Is there a way for me to see or confirm that the SSL certs are being pulled? If I look in my cert store, where should I look?

 

[AbnrangerZay 1]

On 3/15/2020 at 2:05 PM, muzicman0 said:

You know, I never got the email, but it does appear to be working for me. My remote connections say they are secured when I log on. Did you set up a client that tells Google DNS what your public IP is? I use my router, but previously to that I used my qnap Nas. I'm sure there are also independent applications. Can you reach your server from outside your home network?

Am I missing something? What email? Was I, or am I supposed to get an email when the setup initiates?

[Carlo 4560]

Hi, it's not working for you because your DNS is setup incorrectly.
You need an A record with an IP address that points to your WAN IP address.

You can verify this does not work by opening a command prompt and trying either:

ping zay.watchmyemby.com
pin watchmyemby.com

neither work because it can't resolve to an IP address.

[AbnrangerZay 1]

1 hour ago, cayars said:

Hi, it's not working for you because your DNS is setup incorrectly.
You need an A record with an IP address that points to your WAN IP address.

You can verify this does not work by opening a command prompt and trying either:

ping zay.watchmyemby.com
pin watchmyemby.com

neither work because it can't resolve to an IP address.

Thanks for the tip. Do I need to, or should I delete the other A record? Here is what I now have: That is my public IP there.

[Carlo 4560]

I'm still confused by your IPing above.  Why are you setting the domain itself to a non-existent IP of 0.0.0.0?

Let's do this a different way. First do you need anything other that "watchmyemby.com"?

Will this domain be used for anything other than Emby?  It's wouldn't seem so based on the name.
If not get rid of the zay entry and just set the domain A record to your IP.

Then in Emby network settings you enter watchmyemby.com as the remote name (domain).

Regardless of the domain part, if you go to canuseeme.org and run a port check does it pass or fail using the Emby ports?

[AbnrangerZay 1]

55 minutes ago, cayars said:

I'm still confused by your IPing above.  Why are you setting the domain itself to a non-existent IP of 0.0.0.0?

Let's do this a different way. First do you need anything other that "watchmyemby.com"?

Will this domain be used for anything other than Emby?  It's wouldn't seem so based on the name.
If not get rid of the zay entry and just set the domain A record to your IP.

Then in Emby network settings you enter watchmyemby.com as the remote name (domain).

Regardless of the domain part, if you go to canuseeme.org and run a port check does it pass or fail using the Emby ports?

Thanks for your suggestions and patience. No, this will only be used for watching my Emby media remotely. I followed the post and the Zay entry was for the cname and dynamic DNS. Per your last set of instructions, I removed the everything, except just the A record pointing to my public IP address as you see in the below screenshot. Now, again, per the initial set of instructions, an entry for DDNS should be setup as well as a CName, of which I now have none of those. However, I am leaving as is until further instructions. I included screenshots to show that the caddy service is running, and what my domain configuration and Emby network settings are. But to your question about the ping results, no. When I do the port check, they all error out. Although, I may need to give the domain settings more time for them to propagate. I will try it again in a bit and provide a status. Thanks again.

[AbnrangerZay 1]

7 hours ago, cayars said:

Hi, it's not working for you because your DNS is setup incorrectly.
You need an A record with an IP address that points to your WAN IP address.

You can verify this does not work by opening a command prompt and trying either:

ping zay.watchmyemby.com
pin watchmyemby.com

neither work because it can't resolve to an IP address.

Ok, so I can ping watchmyemby.com, but not able to telnet to port 80 or 443. The results from the port check website also shows it is not working, so not sure what else could be wrong. I double checked ports 443 and 80 in my router are forwarded to my Emby server. Now even though the caddy service is running, how do I know that it is actually working? Here are the results of my ping. In fact see if you can ping it from your computer. I also included the information

 

[Carlo 4560]

With Caddy running you have  extra steps to make sure are correct before anything works.
Do you need Caddy for anything other than Emby?  If not I would stop it and go back to a basic setup and work up from there. Example:

First shutdown Caddy so it's not running.
Setup a port forward for port 8096 in your router that points to the Emby Server using port 8096 (don't worry about SSL for now).
Configure Emby networking without the domain name (so it uses the WAN IP address) and set the Secured mode in Emby to Disabled.
Restart Emby Server.

Now test from canyouseeme.org to see if port 8096 is open.
This is the most basic of tests. No point trying to configure anything else until this port shows as open.

If this port check doesn't work we need to figure out why which could be things like:
A firewall blocking your connection
Some other security software or VPN causing the issue
Are you behind a CGNAT your ISP has in place

So can you try that and report back your results?