Ejabbed with letsencrypt certificate

user_6356654 0
Viewed 3303

I'm trying to get Ejabberd to work with letsencrypt certificates on centos7. I keep getting errors about the certificates not being signed by a known CA.

I have created the certificates by certbot, and I joined the privkey and fullchain files to single file.

All c2s connections work fine, but s2s connections don't.

When starting Ejabberd I see the following relevant log entries:

[warning] <0.606.0>@ejabberd_pkix:check_ca_dir:386 CA directory /etc/ssl/certs doesn't contain hashed certificate files; configuring 'ca_path' option might help
[warning] <0.606.0>@ejabberd_pkix:mk_cert_state:240 certificate from /opt/ejabberd/conf/xxxx.pem is invalid: certificate is signed by unknown CA

Connections to for example draugr.de generate the following entries:

[info] <0.793.0>@ejabberd_s2s_in:handle_auth_failure:206 (tls|<0.792.0>) Failed inbound s2s EXTERNAL authentication draugr.de -> XXXXX.net (::FFFF:89.163.212.45): unable to get local issuer certificate

I hope someone can help me out, thanks!

lets-encrypt centos7 ejabberd
3 Answers

[EDIT 2020 may]

It looks like ejabberd now has automatic acme support (meaning it can request the certificate on its own from letsencrypt). So what you read below is obsolete.

As of 2018 november,
Merely installing letsencrypt using certbot is enough click here to see how. Ejabberd uses the provided certificates. Note that you may need to register multiple subdomains for some strict jabber clients to work properly.

conference.yourjabberdomain.com
pubsub.yourjabberdomain.com
upload.yourjabberdomain.com
yourjabberdomain.com

or install a wildcard certificate from letsencrypt

 sudo certbot certonly --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d *.yourjabberdomain.com

I think there is a rule in the ejabberd config file ejabberd.yml that allows this to happen

certfiles:
  - "/etc/letsencrypt/live/*/*.pem"

user_2003990

I was able to solve it myself finally but i am out of office the next few days and can't get you the exact configuration to solve it.

But if I recall correctly I downloaded the CA bundle here https://curl.haxx.se/docs/caextract.html and there was some configuration parameter for ejabberd to use this CA bundle in stead of the default one.

Hope it helps you.

user_63566540

If it is working for c2s and not working for s2s then it looks like the s2s block in configuration file is not updated with certfile. I believe you have something like this for c2s:

port: 5222
    ip: "::"
    module: ejabberd_c2s
    starttls: true
    certfile: 'CERTFILE'
    protocol_options: 'TLSOPTS'

Similarly your s2s block should have:

port: 5269
    ip: "::"
    module: ejabberd_s2s_in
    starttls: true
    certfile: 'CERTFILE'
    protocol_options: 'TLSOPTS'
    max_stanza_size: 131072
    shaper: s2s_shaper
user_61656880
Related