Difficulties enabling SSL

[JamesEdmondsUKPN]

We have a newish installation of Wiki.js on a Windows Server box, and I'm having a bit of difficulty getting SSL enabled.

In the config.yml file, I have changed the below options to the values shown
ssl:
enabled: true
port: 443
format: pfx
pfx: C:\Wiki\ssl\hostname.pfx (also tried using relative path of ./ssl/hostname.pfx)
passphrase: MY_PFX_PASSWORD (both in and not in quotes)
dhparam: both null and 2048 (our key is 2048 bits)

We are running as a service via node-windows, so at this point I restart the service, but the page load times out.

I can't see anything obvious wrong, unless I have some syntax or formatting wrong in these sections, but the documentation doesn't highlight anything specific I need to account for.
I am also not sure where logs are written to, so don't know how to check general logs for any indicators.

Any guidance appreciated

[NGPixel]

You'll need to check the logs to get the error. The logs are in the process output.

[NGPixel]

There's no log files. The logs are displayed as the process output.

Start the process manually (without node-windows) and you'll see the logs.

[JamesEdmondsUKPN]

Thank you for the clarification.

Doesn't appear to be anything alarming in the console ouput:

2023-08-21T14:30:03.786Z [MASTER] warn: Mail is not setup! Please set the configuration in the administration area!
2023-08-21T14:30:04.194Z [MASTER] info: Loading GraphQL Schema...
2023-08-21T14:30:06.151Z [MASTER] info: GraphQL Schema: [ OK ]
2023-08-21T14:30:06.384Z [MASTER] info: HTTP Server on port: [ 80 ]
2023-08-21T14:30:06.405Z [MASTER] info: HTTPS Server on port: [ 443 ]
(node:5476) [DEP0148] DeprecationWarning: Use of deprecated folder mapping "./public/" in the "exports" field module resolution of the package at C:\Wiki\node_modules\extract-files\package.json.
Update this package.json to use a subpath pattern like "./public/*".
(Use `node --trace-deprecation ...` to show where the warning was created)
2023-08-21T14:30:06.428Z [MASTER] info: HTTP Server: [ RUNNING ]
2023-08-21T14:30:06.428Z [MASTER] info: HTTPS Server: [ RUNNING ]
2023-08-21T14:30:06.584Z [MASTER] info: No new analytics providers found: [ SKIPPED ]
2023-08-21T14:30:06.609Z [MASTER] info: Loaded 21 authentication strategies: [ OK ]
2023-08-21T14:30:06.633Z [MASTER] info: No new comment providers found: [ SKIPPED ]

The page loads over HTTP, but over HTTPS I just get "the server took too long to respond"

[JamesEdmondsUKPN]

Is there anywhere else I can check for other logs that might suggest what the issue is? Thanks

[JamesEdmondsUKPN]

Anything else I can check please, or anything else I can try to diagnose?

[JamesEdmondsUKPN]

Anyone able to offer me any guidance here please?

[JamesEdmondsUKPN]

Is there anything else I can to do diagnose this please, as I am at a loss, and would really like to get this resolved!

[JamesEdmondsUKPN]

Anyone able to offer me any guidance please?

[JamesEdmondsUKPN]

Can anyone help me please?

[JamesEdmondsUKPN]

Can anyone assist me any further please?

For ref, I have found that in IE locally on the server, HTTPS the page does load (although IE give a cert error, but I see nothing wrong with the cert).
Loading in Edge remotely, it just says the server took too long to respond.

I have followed the instructions for enabling SSL using a PFX, and it's all quite straight forward config wise, so does this suggest a possible issue with the cert?
Are there any specific requirements/limitations on the cert I need to account for?

[JamesEdmondsUKPN]

Still no one able to assist me with diagnosing this issue further?

[JamesEdmondsUKPN]

Please can someone, anyone, help me with this?

[NGPixel]

Please stop posting the same message every week. You're running on Windows with a pfx certificate. There's little chance someone will know what the issue in your setup is. Asking over and over every single week won't change that.

If you can't get it to work then use a reverse proxy like nginx, apache or even IIS to handle your SSL termination instead. There are tons of guides and resources on the subject.

[JamesEdmondsUKPN]

Sorry, but my assumption was that what we are doing is supported by the product, given it's in the documentation and the configuration.
If we have followed the documentation and it doesn't work, then either I've done something wrong and am after some assistance on how to diagnose the issue within Wiki,JS (as there are zero errors reported in the only place you kindly suggested I look), or what I've done is correct and there is something wrong with the product?

We are in a highly locked down environment, so simply setting up a reverse proxy may not be possible or practical.
We can look at using IIS, but as it is supposed to be supported within Wiki.JS, I was trying not to over complicate things.

I also find it odd that getting support for Windows and certificates is so difficult, given how prevalent Windows is in enterprise environments? Why is it this is such an unusual situation that you feel there's little chance anyone can help?
Is it purely because of our use of a PFX, or our use of Windows rather than Linux?

[NGPixel]

This is a community-supported app. The overwhelming majority of users are deploying to docker / linux environments. So you can't expect to have as many responses on an issue when using an environment with very little usage.

Different options are provided on a best effort basis. We simply expose the available options from the underlying libraries. It doesn't guarantee someone will be able to help you if you use such option.

The SSL options in Wiki.js are mostly provided because some users run their instance in a small environment directly against the internet. It's more of a fallback / basic solution. Most corporate environments would instead use a reverse-proxy (whether locally or using something like Cloudflare) and not handle SSL directly in Wiki.js.

[JamesEdmondsUKPN]

Thanks.

I'm sure you can appreciate how frustrating it can be to pose a question, and just get nothing back whilst other questions are being answered.
Something to the above effect is all I needed, and means I will now move on and look at other options.

[BPowell76]

@JamesEdmondsUKPN you've probably moved on, but I managed to get it working. It was a little weird, but what I ended up doing is putting a copy of the cert and key file in the working directory of the wiki at the same level as the config file. The reasoning for this is the system SSL directory is owned by root and didn't want to give the local user access to that.

This is for an internal site so I didn't really care.

Then with Apache I reverse proxy port 3443 to 443 (and also limit access to 192.168.0.0) and have the apache config reference the system SSL files. It works for me.

[JamesEdmondsUKPN]

Interesting, thanks.

We ended up just installing IIS, using that to terminate the SSL connection, and then redirect locally to the Wiki.
Works for us, but your input is well received 👍