[英]Telegram Bot - Webhook SSL error with letsencrypt Certificate
I've tried to fix this error now for two day and still haven't found a single thing that works... So here is my problem:我已经尝试修复此错误两天了,但仍然没有找到任何可行的方法......所以这是我的问题:
I previously had a Telegram Bot setup with Certbot (letsencrypt) on a Raspberry Pi and it worked perfectly.我之前在 Raspberry Pi 上使用 Certbot (letsencrypt) 设置了 Telegram Bot,它运行良好。 Now I wanted to build the same thing on my new HomeServer (A Manjaro Linux Machine).
现在我想在我的新 HomeServer( Manjaro Linux 机器)上构建相同的东西。
So I installed Apache and Certbot and it works perfectly with any browser to access my site with https://<mydomain>
.所以我安装了 Apache 和 Certbot ,它可以完美地与任何浏览器一起使用
https://<mydomain>
访问我的网站。 But... when I set the Webhook of the Telegram bot with the Certificate you have to pass like this:但是......当我使用证书设置 Telegram 机器人的 Webhook 时,您必须像这样通过:
curl -F "url=https://<mydomain>/botTelegram/index.php" -F "certificate=@/etc/letsencrypt/live/<mydomain>/fullchain.pem" https://api.telegram.org/bot723985628:AAHiEXNJgXZ-mGprEhGNc1QxiVpGfhxK_9A/setWebhook
it always gives me back the same error :它总是给我同样的错误:
{
"ok": true,
"result": {
"url": "<myDomain>",
"has_custom_certificate": true,
"pending_update_count": 1,
"last_error_date": 1588255882,
"last_error_message": "SSL error {error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed}",
"max_connections": 40
}
}
So then I searched for solutions, and what everyone kept saying, was that you should try to test your site with https://www.ssllabs.com/ssltest/analyze.html?d=<mydomain>&hideResults=on
and then check if under Chain issues something else than "None" is written, and in that case you would have to give the server the "Full Certificate Chain".所以然后我搜索了解决方案,每个人都在说,你应该尝试用
https://www.ssllabs.com/ssltest/analyze.html?d=<mydomain>&hideResults=on
测试你的网站,然后检查如果在链下发出的内容不是“无”,在这种情况下,您必须为服务器提供“完整证书链”。 So I did run this test, but there Was written "None", because I already gave Apache the fullchain.pem
Certificate.所以我确实运行了这个测试,但是写的是“None”,因为我已经给 Apache 提供了
fullchain.pem
证书。
Since Certbot created multiple Certificates: I also tried to pass the chain.pem
and the cert.pem
to the /setWebhook request, but there the same error occurs.由于 Certbot 创建了多个证书:我还尝试将
chain.pem
和cert.pem
传递给/setWebhook请求,但发生了同样的错误。
Here is how i created them:这是我创建它们的方式:
certbot certonly --webroot /srv/http -d <myfirstdomain> -d <myseconddomain>
So now I really don't know how to fix this, cause SSL works for the Browser, just not for the Telegram Webhook...所以现在我真的不知道如何解决这个问题,因为 SSL 适用于浏览器,但不适用于 Telegram Webhook ...
In case here is a part of my /etc/httpd/conf/extra/httpd-ssl.conf
:如果这是我的
/etc/httpd/conf/extra/httpd-ssl.conf
的一部分:
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. Keep
# in mind that if you have both an RSA and a DSA certificate you
# can configure both in parallel (to also allow the use of DSA
# ciphers, etc.)
# Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
# require an ECC certificate which can also be configured in
# parallel.
SSLCertificateFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"
#SSLCertificateFile "/etc/httpd/conf/server-dsa.crt"
#SSLCertificateFile "/etc/httpd/conf/server-ecc.crt"
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
# ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile "/etc/letsencrypt/live/<mydomain>/privkey.pem"
#SSLCertificateKeyFile "/etc/httpd/conf/server.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-dsa.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-ecc.key"
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convenience.
#SSLCertificateChainFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath "/etc/httpd/conf/ssl.crt"
#SSLCACertificateFile "/etc/httpd/conf/ssl.crt/ca-bundle.crt"
Well then, I hope someone is able to help me out with this, because I really have no clue what's wrong here...那么,我希望有人能够帮助我解决这个问题,因为我真的不知道这里出了什么问题......
EDIT:编辑:
I now deleted the Certificates, and recreated them with Certbot but with the --apache option like this certbot --apache -d <myfirstdomain> -d <myseconddomain>
but it still didn't work, I still get the same error...我现在删除了证书,并使用 Certbot 重新创建了它们,但使用了 --apache 选项,例如
certbot --apache -d <myfirstdomain> -d <myseconddomain>
但它仍然不起作用,我仍然得到同样的错误.. .
Here is the new config, created by Certbot at /etc/letsencrypt/options-ssl-apache.conf
and linked in the Apache config:这是由 Certbot 在
/etc/letsencrypt/options-ssl-apache.conf
创建并在 Apache 配置中链接的新配置:
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384>SSLHonorCipherOrder on
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common```
To fix this I simply had to make the .../setWebhook
Request without passing the Certificate and put https://
in front of the URL.为了解决这个问题,我只需要在不通过证书的情况下发出
.../setWebhook
请求,并将https://
放在 URL 前面。
Because I thought Certbots Certificates are "Self-Signed", but they obviously aren't, what was I thinking?因为我认为 Certbots 证书是“自签名”的,但显然不是,我在想什么? I can't believe that this was such a simple thing, that I overlooked...
我不敢相信这是一件如此简单的事情,以至于我忽略了...
Well then, still I hope this helps anyone how maybe has the same stupid problem.那么,我仍然希望这对任何可能遇到同样愚蠢问题的人有所帮助。 :)
:)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.