regarding this question there is the following network setup. At home there is a cubieboard running an Apache server behind me router. Problem is that my ISP only gives me a IPv6 address and uses DS-Lite for outgoing IPv4 connections.

So when trying to connect from IPv4 (because IPv6 is still not common) I made use of my root server which has a static IP address to forward the request to my cubieboard over IPv6.

I registered my own domain and on the cubieboard there is a script to sync the domain with the daily changing IPv6 address from my ISP.

On my root server there is a socat process running to listen on port X[IPv4] and forward it to my domain on port Y[IPv6].

While this works perfect and I can access my cubieboard from IPv4 I don't know how to setup SSL with my apache server on the cubieboard so I can access it with SSL over this IPv4 to IPv6 connection.

I already own a SSL certificate from Let's Encrypt which can be created on the cubieboard since Let's Encrypt supports IPv6 only domains. But since this domain is only connected to the IPv6 address I cannot simply use this in the browser where I only have IPv4 available.

                      localhost:1234[v4] to
-------------------   mydomain.com:80[IPv6]    -------------------------
| cubieboard IPv6 |  <-----------------------> | root server IPv4/6    |
| apache port 80  |                            | socat Port 1234[Ipv4] |
-------------------                            -------------------------
| SSL certificate   |
| mydomain.com IPv6 |

Your SSL-setup should work for the most part in the network-setup you have. TLS (the current name of SSL) does not care if it is being run over IPv4 or IPv6, or if it's translated between the two.

One issue that you may run in to is that TLS-implementations check the hostname you typed against the certificate. So if you connect to https://root-server:1234/, you will probably get the certificate of mydomain.com, which the browser will find invalid.

To solve this issue, you could add the IPv4-address of your root-server to the DNS-entry of mydomain.com. That way, you can connect to https://myd-om-ain.com:1234/, and the hostname will match. The downside of this is that Let's Encrypt may start failing, since it will connect to TCP port 80 on mydomain.com, which may end up on your root-server (and not being forwarded).

PS: I had to obscure the links because of superuser.com rules. My apologies

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.