Telegram Bot - Webhook SSL错误，使用Letencrypt证书。

Question

我已经尝试解决这个错误两天了，但还是没有找到一个有效的方法...... 所以我的问题是这样的。

我之前在Raspberry Pi上用Certbot (Letencrypt)安装了一个Telegram机器人，它工作得很完美。现在，我想在我的新HomeServer上建立同样的东西（A Manjaro Linux机器）。)

所以我安装了Apache和Certbot，然后它 可与任何浏览器完美配合 访问我的网站，用 https://<mydomain>. 但是......当我用证书设置Telegram机器人的Webhook时，你必须像这样通过。

curl -F "url=https://mrmobi.ddns.net/botTelegram/index.php" -F "certificate=@/etc/letsencrypt/live/mrmobi.ddns.net/fullchain.pem" https://api.telegram.org/bot723985628:AAHiEXNJgXZ-mGprEhGNc1QxiVpGfhxK_9A/setWebhook

它 总是给我同样的错误:

{
    "ok": true,
    "result": {
        "url": "<myDomain>",
        "has_custom_certificate": true,
        "pending_update_count": 1,
        "last_error_date": 1588255882,
        "last_error_message": "SSL error {error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed}",
        "max_connections": 40
    }
}

所以我找了很多解决方案，大家都在说，你应该尝试用测试你的网站。https://www.ssllabs.com/ssltest/analyze.html?d=<mydomain>&hideResults=on 然后检查，如果链问题下的东西比 "无 "写，在这种情况下，你将不得不给服务器的 "完整的证书链"。所以，我没有运行这个测试，但有写 "无"，因为我已经给Apache的 fullchain.pem 证书。

链问题截图

由于Certbot创建了多个证书。我也试图通过 chain.pem 和 cert.pem 至 设置Webhook 请求，但也出现了同样的错误。

这是我如何创建它们的。

certbot certonly --webroot /srv/http -d <myfirstdomain> -d <myseconddomain>

所以现在我真的不知道如何解决这个问题, 因为SSL在浏览器上是有效的, 但在Telegram Webhook上就不行了...

如果是这样的话，这里有一部分是我的 /etc/httpd/conf/extra/httpd-ssl.conf:

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
#   in mind that if you have both an RSA and a DSA certificate you
#   can configure both in parallel (to also allow the use of DSA
#   ciphers, etc.)
#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
#   require an ECC certificate which can also be configured in
#   parallel.
SSLCertificateFile "/etc/letsencrypt/live/mrmobi.ddns.net/fullchain.pem"
#SSLCertificateFile "/etc/httpd/conf/server-dsa.crt"
#SSLCertificateFile "/etc/httpd/conf/server-ecc.crt"

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
#   ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile "/etc/letsencrypt/live/mrmobi.ddns.net/privkey.pem"
#SSLCertificateKeyFile "/etc/httpd/conf/server.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-dsa.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-ecc.key"

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convenience.
#SSLCertificateChainFile "/etc/letsencrypt/live/mrmobi.ddns.net/fullchain.pem"

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   Note: Inside SSLCACertificatePath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
#SSLCACertificatePath "/etc/httpd/conf/ssl.crt"
#SSLCACertificateFile "/etc/httpd/conf/ssl.crt/ca-bundle.crt"

那么，我希望有人能够帮我解决这个问题，因为我真的不知道这里有什么问题......

EDIT:

我现在删除了证书，并用Certbot重新创建了它们，但使用了 --apache选项，就像这样。certbot --apache -d <myfirstdomain> -d <myseconddomain> 但还是不行，我还是得到同样的错误信息......

以下是Certbot的新配置。/etc/letsencrypt/options-ssl-apache.conf 并链接到Apache配置中。

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384>SSLHonorCipherOrder     on

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common```

Answer 1

为了解决这个问题，我只需要将 .../setWebhook 要求不通过证书，把 https:// 在URL的前面，我还以为Certbots证书是 "自签名"，但显然不是，我是怎么想的？

因为我以为Certbots证书是 "自签 "的，但显然不是，我在想什么呢？我不能相信这是一个如此简单的事情，我忽略了... ...

好吧，那么，我还是希望这能帮助任何人，也许有同样的愚蠢的问题。 :)