Did a setup last week, following this post. Just adapt some lines of ACL & route settings to your needs and you're done in 20 minutes. 

had the same error - re-creating new tls certs helped me here.