Gemini Protocol Troubleshooting

[geomlattice]

I cannot access my Gemini protocol server over port 1965.

I'm not sure what's wrong, but I do know that gemini doesn't use https but enforces TLS within the protocol itself. Maybe getting rid of the letsencrypt info for my domain entry could be something worth attempting in the spirit of troubleshooting? Any comments on this, suggestions, insights etc regarding this situation?

Please refer here to the Wikipedia for Gemini

[geomlattice]

Seems like TLS setup is definitely something to consider.

Though I'm using orbit written in elixir, here's information from jetforce

TLS Certificates
The gemini specification requires that all connections be sent over TLS.

If you do not provide a TLS certificate file using the --tls-certfile flag, jetforce will automatically generate a temporary cert for you to use. This is great for making development easier, but before you expose your server to the public internet you should setup something more permanent. You can generate your own self-signed server certificate, or obtain one from a Certificate Authority like Let's Encrypt.

Here's an example openssl command that you can use to generate a self-signed certificate:

$ openssl req -newkey rsa:2048 -nodes -keyout {hostname}.key
-nodes -x509 -out {hostname}.crt -subj "/CN={hostname}"
Jetforce also supports TLS client certificates (both self-signed and CA authorised). Requests that are made with client certificates will include additional CGI/environment variables with information about the TLS connection.

You can specify a CA for client validation with the --tls-cafile or --tls-capath flags. Connections validated by the CA will have the TLS_CLIENT_AUTHORISED environment variable set to True. Instructions on how to generate CA's are outside of the scope of this readme, but you can find many helpful tutorials online.

Copypasta ends there. I'll need to look into what my elixir gemini server is doing regarding TLS

[DEV-DIBSTER]

I would have to check if I have time, this likely will fall out of our control just due to how it works. The only things we can control would be our Cloudflare settings, but with proxied: false set on any domain, most, if not all these restrictions are not shown.

My only other thought process is the TLD .dev, owned by Google Registry subsidiary Charleston Road Registry Inc, enforces HSTS which will enforce HTTPS on all traffic. No HTTP traffic is allowed on this.

[geomlattice]

If the ambiguities are too murky, that is fair. Gemini traffic is not http whatsoever.

I could post something about this situation in a bbs/forum where folks who have experience with domain configuration for Gemini servers could provide further information. Is there anything you would like to know in particular from others who have worked out pointing normal domains to Gemini servers?

I am too inexperienced here to help with troubleshooting and inferencing, but I can bridge information as needed perhaps?

[DEV-DIBSTER]

To preface this, this is the first time I've ever heard of this protocol, let alone specifics.

If the ambiguities are too murky, that is fair. Gemini traffic is not http whatsoever.

This makes me suspect that you'd would just need to issue a self signed certificate, which is what you've attempted I think. Clarify if this is the case.

Since letsencrypt should just be able to generate these certificates just fine. Since we just provide DNS (even more true with proxied: false). This just seems like they want self signed certificates which there should be some guides for.

I think this falls outside of our control, as it doesn't retain to DNS. I double checked with Cloudflare, Cloudflare proxied through it's network will cause some ports to be blocked. Since there is no proxying happening on your subdomain (it's just DNS), there isn't anything happening here.

I still believe it's has to do with the way certificates are treated by browsers with .dev TLD and Gemini, which appears to use a "TOFU" (Trust On First Use) model or self-signed certificates. .dev domains are hard-coded into browsers to require valid, CA-signed certificates for HTTP over TLS.

[geomlattice]

Thank you for the ongoing speculation and hypothesis proposal. I'll consider these suggestions