I'm trying to make my own MDM server and I'm having trouble allowing nginx to proxy the connection. The web app I'm making can accept http requests so I require nginx. I'm using a certificate from letsencrypt. Every time I try to enroll a phone it instantly rejects at nginx. I have tried multiple cipher options in nginx.
I found the following link and my cert supports all except the DHE ones but they say you only need 1. (https://developer.apple.com/forums/thread/128482?answerId=404052022#404052022)
What else can I do?
2025/05/21 14:39:44 [info] 105709#105709: *2887 peer closed connection in SSL handshake while SSL handshaking, client: 27.32.155.108, server: 0.0.0.0:9234
2025/05/21 14:41:42 [info] 106014#106014: *2891 peer closed connection in SSL handshake while SSL handshaking, client: 27.32.155.108, server: 0.0.0.0:9234
2025/05/21 14:42:32 [info] 106134#106134: *89 peer closed connection in SSL handshake while SSL handshaking, client: 27.32.155.108, server: 0.0.0.0:9234
2025/05/21 15:09:13 [info] 106132#106132: *124 client timed out (110: Connection timed out) while waiting for request, client: 172.40.1.61, server: 0.0.0.0:9234
below from ssllabs.com
upstream backendmdmios {
server 172.40.1.61:6744;
}
server {
listen 9234 ssl;
http2 on;
server_name mdm.domainplaceholder.com;
error_log /etc/nginx/logs/ios.com.error.log debug; # error;
ssl_certificate /etc/letsencrypt/live/mdm.domainplaceholder.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mdm.domainplaceholder.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
#ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-CBC-SHA256:ECDHE-RSA-AES128-CBC-SHA:ECDHE-RSA-AES256-GCM-SHA384;
#ssl_ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
#ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:!3DES:!CAMELLIA;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparams.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://backendmdmios$request_uri;
}
}
