iOS cannot connect to server

[clemone210]

Hello,

since a few days I cannot connect anymore trough VPN to VW in the Bitwarden iOS App with the latest version.

Vaultwarden is running on a lxc container with only vaultwarden within docker compose as well as cloudflared tunnel. Its a single stack.
The vaultwarden server / web-ui is reachable by ip:88.
The domain is pointing to hostname:80 which works perfectly to reach the web-ui.

In my local network I can access the vaultwarden server trough the ip:88, where the bitwarden app is also using it.
So my macbook as well as my windows bitwarden app / browser extension are all connected trough ip:88 which works well. Everything syncs.

Also I can access ip:88 trough headscale wireguard vpn with my macbook bitwarden app as well as browser extension.

The only thing which is not working is now the iOS app, when I want to connect trough the vpn to the ip:88 it gets me the error:

Exception message: The resource
could not be loaded because the App
Transport Security policy requires
the use of a secure connection.

Bitwarden app version:
2024.5.1

Vaultwarden server
2024.1.2

Any idea how to fix this?

[clemone210]

Addition:
Within the same network its possible to connect trough ip:88 with the iOS app.

[BlackDex]

Can you connect via safari on the mobile device to the web-vault?
Maybe the certificate is missing a chain and that causes weird issues.

[Kobnar]

The more I dig the more it looks like this is an iOS/nginx issue. It's definitely not a Vaultwarden issue.

My iPhone 15 is the only device that's having issues with SSL connections. None of the HTTPs routes work. I can't log into any services. Every other device on my network can access everything I'm hosting just fine (including MacOS devices). Like I said, the desktop Bitwarden client works just fine, too.

I've been bashing my head against the wall here for a bit. The closest I've gotten is a flash of a page loading before something goes sideways and Safari/Brave redirect to my root domain. Time to sleep and see if I find a solution tomorrow.

[BlackDex]

Be sure to see if you have TLS1.2 active. Only TLS1.3 could cause issues with some iOS apps. Maybe even TLS1.1 is needed? Or some specific ciphers which are not available right now?

[Kobnar]

Man.. what a weird road to go down..

Okay so I confirmed that my reverse proxy was working w/ TLS 1.2 and 1.3, made a bunch of proxy-related changes to the config (based on several other threads), turned off the firewall of my proxy server, etc.

None of that worked.

I had a hunch that iOS was doing big brain routing and DNS/SSL resolution, so I forced it to only use the DNS server on my LAN by shutting off cell data and manually configuring the DNS server IP address. That at least got me to partially loading pages (instead of redirects to the root domain) or secure connection complaints.

This morning I just yolo'd the top level CNAME records for my root domain (at porkbun) and the wildcarded subdomains into oblivion (they were previously set to be an alias for pixie.porkbun.com).

Now everything works.

Thanks for sticking with me. The problem has nothing to do with Vaultwarden, but now anybody who has this symptom of a borked DNS resolution/configuration might get pointed in the right direction.

[jack228cn]

I can access web server, but I can not access IOS client with same URL of server which I built in QNAP docker. Is anyone can help me?