This is an unusual configuration that we haven't tested. Is there an option in nginx to pass through all of the HTTP headers from SecuritySpy to the client? As long as the headers are transmitted intact, and you are using version 4.0.8 of SecuritySpy, there is no reason why this shouldn't work. If you are using 4.0.8 and still getting this error, it must be because nginx is modifying the HTTP headers on the way through for some reason.

I'm running 4.0.8 on MacOS 10.11.6.

No, that doesn't fix it.

One way I was able to get it to work was to both disable SSL in the nginx config and listen on 8000 instead. The iOS app seems to like this, but not having SSL is deal breaker.

server {
#listen 8001 ssl;
listen 8000 ;
server_name my.fqdn.net;
location / {
proxy_pass https://192.168.1.10:8001;
proxy_buffering off;
proxy_read_timeout 180;
proxy_connect_timeout 90;
proxy_redirect off;
proxy_pass_header Server;
proxy_pass_request_headers on;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 8001;
proxy_set_header Host $host;
}
}

I'll keep tinkering around to see what I can figure out. If that doesn't work, I'll have to expose the SecuritySpy system directly to the internet, something I've been trying to avoid.

Error is the same.

SSL certificate is valid.

This works fine in Chrome, Firefox, and the Spyglass iOS app.

(one more thing, the fact that i cant save a profile, even a non working profile, in the SecuritySpy iOS app makes it harder to troubleshoot since I have to reenter everything (hostname, port, username, password) every single time. would be nice to let you configure and save a profile regardless of success.)

I got around this by not specifying a port or username/password. Just put in the host name and it connects, prompts for credentials, and you're good to go.

even without authentication the application respond "The server that responded is not SecuritySpy".

Than is an ssl error.
@jms703 do you confirm that you solve without an ssl connection?

Thanks

@martinorob

Here is my nginx config:


worker_processes 1;
worker_rlimit_nofile 1024;
events {
worker_connections 800;
}


http {
server_tokens off;
include mime.types;
default_type application/octet-stream;
index index.html ;
underscores_in_headers on ;

ssl_certificate /etc/ssl/server.crt ;
ssl_certificate_key /etc/ssl/private/server.key ;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

ssl_dhparam /etc/ssl/certs/dhparam.pem;

ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;

server {
listen 80;
server_name www.domain.com;
root /var/www/htdocs;
location /.well-known/acme-challenge {
alias /var/www/letsencrypt;
default_type text/plain;
}
location / {
deny all;
return 404;
}
}

server {
listen 443 ssl;
server_name www.domain.com;
root /var/www/htdocs;
}

server {
listen 8001 ssl;
server_name securityspy.domain.com;
location / {
proxy_buffering off;
proxy_read_timeout 180;
proxy_connect_timeout 90;
proxy_redirect off;
proxy_pass_header Server;
proxy_pass_request_headers on;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 8001;
proxy_pass https://10.1.3.20:8001;
}
}
}

The relevant part is the clause at the bottom. I listen on 8001 on the internet. SSL is enabled. The cert is a Let's Encrypt cert, so no warnings or issues with invalid certs.

Also, I did not solve by disabling SSL. I solved by not specifying SSL in the iOS app. As you can see from my config, you cannot connect without SSL.

*even because with Spyglass works perfectly on port 443.