Telegram Bot API Webhooks Self-signed Certificate issue

问题:

I'm working on a Ruby language server to manage multiple Telegram Bots via setwebhooks

BTW, I'll delivery the server as opensource at BOTServer

PROBLEM

I have troubles receiving webhook updates from Telegram Bot API Server. I have set a webhook token (Telegram reply "success") but I do not receive any update on the succesfully configured webhook.

I think the problem could be around self-signed Certificate mysteries. See old reddit question and answers.

I have similar problem and I fair the point is in some "misunderstanding" between Telegram Bot API Server that send HTTPs webhooks updates and the bot server receving webhooks (I use nginx as proxy/https SSL certificate handler).

It seems that someone solved the issue configuring nginx with a certificate "chain"; I'm pretty ingnorant in certificates tricks and so I ask:

QUESTION

May someone can post info, to configure nginx (any ssl web server!) with detailed settings / step-by step for dummies, showing how to pass from .key and .pem files described here: https://core.telegram.org/bots/self-signed to set-up the certificate "chain" to configure in nginx config, to be "accepted" by Telegram Bot API Server ?

BTW, my nginx config now:

upstream backend {   server 127.0.0.1:3000; }  # # HTTPS server # server {   listen 8443 ssl;   server_name myhost.com;    ssl on;   ssl_certificate /mypath/ssl/PUBLIC.pem;   ssl_certificate_key /mypath/ssl/PRIVATE.key;    ssl_session_timeout 5m;    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;   ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";   ssl_prefer_server_ciphers on;    location @backend {     proxy_pass http://backend;   }    location / {     try_files $uri @backend;   } } 

where PRIVATE.key + PUBLIC.pem files are that one generated following guidelines: Using self-signed certificates:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout PRIVATE.key -x509 -days 365 -out PUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE" 

thanks

giorgio

回答1:

I answer myself, to share solution found here: https://stackoverflow.com/a/33260827/1786393

the point was not the mentioned nginx configuration, but the PEM file:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout YOURPRIVATE.key -x509 -days 365 -out YOURPUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE" 

YOURDOMAIN.EXAMPLE in the subj strig of openssl must be real hostname of your server that receive webhooks.

回答2:

the solution that works for me:

I generated key pairs: openssl genrsa -out webhook_pkey.pem 2048 and openssl req -new -x509 -days 3650 -key webhook_pkey.pem -out webhook_cert.pem

don't forget to give FQDN name. give your host's ip at least

added it to nginx config

server {     listen      8443 ssl;     server_name MY_IP;     charset     utf-8;     client_max_body_size 75M;     ssl_certificate /var/www/myproject/tg_keys/webhook_cert.pem;     ssl_certificate_key /var/www/myproject/tg_keys/webhook_pkey.pem;      location / { try_files $uri @yourapplication; }     location @yourapplication {         include uwsgi_params;         uwsgi_pass unix:/var/www/myproject/hb.sock;     } } 

回答3:

cURL options:

      CURLOPT_SSL_VERIFYPEER = false     CURLOPT_SSL_VERIFYHOST = false  

文章来源: Telegram Bot API Webhooks Self-signed Certificate issue