1

I've tried to fix this error now for two day and still haven't found a single thing that works... So here is my problem:

I previously had a Telegram Bot setup with Certbot (letsencrypt) on a Raspberry Pi and it worked perfectly. Now I wanted to build the same thing on my new HomeServer (A Manjaro Linux Machine).

So I installed Apache and Certbot and it works perfectly with any browser to access my site with https://<mydomain>. But... when I set the Webhook of the Telegram bot with the Certificate you have to pass like this:

curl -F "url=https://<mydomain>/botTelegram/index.php" -F "certificate=@/etc/letsencrypt/live/<mydomain>/fullchain.pem" https://api.telegram.org/bot723985628:AAHiEXNJgXZ-mGprEhGNc1QxiVpGfhxK_9A/setWebhook

it always gives me back the same error:

{
    "ok": true,
    "result": {
        "url": "<myDomain>",
        "has_custom_certificate": true,
        "pending_update_count": 1,
        "last_error_date": 1588255882,
        "last_error_message": "SSL error {error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed}",
        "max_connections": 40
    }
}

So then I searched for solutions, and what everyone kept saying, was that you should try to test your site with https://www.ssllabs.com/ssltest/analyze.html?d=<mydomain>&hideResults=on and then check if under Chain issues something else than "None" is written, and in that case you would have to give the server the "Full Certificate Chain". So I did run this test, but there Was written "None", because I already gave Apache the fullchain.pem Certificate.

Chain Issues Screenshot

Since Certbot created multiple Certificates: I also tried to pass the chain.pem and the cert.pem to the /setWebhook request, but there the same error occurs.

Here is how i created them:

certbot certonly --webroot /srv/http -d <myfirstdomain> -d <myseconddomain>

So now I really don't know how to fix this, cause SSL works for the Browser, just not for the Telegram Webhook...

In case here is a part of my /etc/httpd/conf/extra/httpd-ssl.conf:

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
#   in mind that if you have both an RSA and a DSA certificate you
#   can configure both in parallel (to also allow the use of DSA
#   ciphers, etc.)
#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
#   require an ECC certificate which can also be configured in
#   parallel.
SSLCertificateFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"
#SSLCertificateFile "/etc/httpd/conf/server-dsa.crt"
#SSLCertificateFile "/etc/httpd/conf/server-ecc.crt"

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
#   ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile "/etc/letsencrypt/live/<mydomain>/privkey.pem"
#SSLCertificateKeyFile "/etc/httpd/conf/server.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-dsa.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-ecc.key"

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convenience.
#SSLCertificateChainFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   Note: Inside SSLCACertificatePath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
#SSLCACertificatePath "/etc/httpd/conf/ssl.crt"
#SSLCACertificateFile "/etc/httpd/conf/ssl.crt/ca-bundle.crt"

Well then, I hope someone is able to help me out with this, because I really have no clue what's wrong here...

EDIT:

I now deleted the Certificates, and recreated them with Certbot but with the --apache option like this certbot --apache -d <myfirstdomain> -d <myseconddomain> but it still didn't work, I still get the same error...

Here is the new config, created by Certbot at /etc/letsencrypt/options-ssl-apache.conf and linked in the Apache config:


# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384>SSLHonorCipherOrder     on

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common```

1 Answer 1

2

To fix this I simply had to make the .../setWebhook Request without passing the Certificate and put https:// in front of the URL.

Because I thought Certbots Certificates are "Self-Signed", but they obviously aren't, what was I thinking? I can't believe that this was such a simple thing, that I overlooked...

Well then, still I hope this helps anyone how maybe has the same stupid problem. :)

Sign up to request clarification or add additional context in comments.

2 Comments

I am having this problem too. But I did not understand your answer. How exactly did you solve it?
To make my Telegram-Bot work I was trying to send the self-signed Cert with the .../setWebhook Web-Request, because I thought it would be necessary like it was described here in the Docs. But instead I realized, that for self-signed Certificates this is not necessary, I think its only needed if you use an CA-approved cert. So just do your request like the following: https://api.telegram.org/<botAPI-Key>/setWebhook?url=https://<mydomain.com>/botTelegram/index.php Make sure to give a https:// link to your Site ^^

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.