Page 1 of 1

WAN access: Chrome works, but not BI Android app

Posted: Wed Mar 17, 2021 10:33 pm
by wmcneil
I am able to access my BI webserver using the chrome browser on my android phone, but the exact same URL will not work with the BI android app. I have tried uninstalling and reinstalling the BI app, and rebooting the phone. I know that the url is correct because I am doing a copy and paste between BI and the chome browser. I am using stunnel so that my WAN connection can be secure (https)....The BI app connects correctly via the LAN (when my phone is connected to the local LAN of course)....When I am testing the WAN connection, I have my phone's wifi turned off.

I sent my debug info to blueiris support (I have an extended support subscription), but they have not been able to help so far. I'm out of ideas, so I thought I would see if anyone else has anything else to suggest.

Re: WAN access: Chrome works, but not BI Android app

Posted: Fri Mar 19, 2021 12:23 pm
by wmcneil
I figured this out. It was caused by the change to the BI android app to no longer allow connection to the BI server using https unless there is a valid certificate. This is described in this forum thread: https://blueirissoftware.com/forum/view ... f=4&t=2093

My BI server is running on windows, and I am using stunnel, so I was able to fix this by using the certbot windows client and the Lets Encrypt service to obtain a valid certificate. There is an example of doing this in the thread link above. The certbot instructions are here:
https://certbot.eff.org/instructions.

Some important points about the certbot install:

* You must have port 80 forwarded to the machine you are running stunnel on
* The default command to obtain the certificate ( certbot certonly --standalone --dry-run ) requires that you not have any web server running on port 80 at the time you are running the command
* Firewalls may block the challenge communication that certbot is using, so disable any firewalls if you are having trouble
* Use the --dry-run flag until everything is working, then run a final time without it. There are aggressive rate limits in place, and it is easy to violate them. The limits are much higher when using the --dry-run flag, so you will most likely not have any problems if you use it for all but your final attempt.
* The Lets Encrypt certificate expires after 90 days unless auto renewal is working. The certbot directions include instructions on how to test if auto renewal is working.