Rocksolid Light

Welcome to Rocksolid Light

mail  files  register  newsreader  groups  login

Message-ID:  

You don't have to know how the computer works, just how to work the computer.


computers / Rocksolid Nodes Help / Re: [rslight] thunderbird and letsencrypt problems

SubjectAuthor
* [rslight] thunderbird and letsencrypt problemsSugarBug
`* Re: [rslight] thunderbird and letsencrypt problemsRetro Guy
 `* Re: [rslight] thunderbird and letsencrypt problemsSugarBug
  `* Re: [rslight] thunderbird and letsencrypt problemsRetro Guy
   `- Re: [rslight] thunderbird and letsencrypt problemsRetro Guy

1
[rslight] thunderbird and letsencrypt problems

<upv6c2$2bt92$1@paganini.bofh.team>

  copy mid

https://news.novabbs.org/computers/article-flat.php?id=950&group=rocksolid.nodes.help#950

  copy link   Newsgroups: rocksolid.nodes.help
Path: i2pn2.org!i2pn.org!paganini.bofh.team!tor-network!not-for-mail
From: 3883@sugar.bug (SugarBug)
Newsgroups: rocksolid.nodes.help
Subject: [rslight] thunderbird and letsencrypt problems
Date: Wed, 7 Feb 2024 00:04:25 -0600
Organization: To protect and to server
Message-ID: <upv6c2$2bt92$1@paganini.bofh.team>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Injection-Date: Wed, 7 Feb 2024 06:01:39 -0000 (UTC)
Injection-Info: paganini.bofh.team; logging-data="2487586"; posting-host="lwlLyVBwDY1MbKmPZJ0eXA.user.paganini.bofh.team"; mail-complaints-to="usenet@bofh.team"; posting-account="9dIQLXBM7WM9KzA+yjdR4A";
Cancel-Lock: sha256:gse/C79q8/mmoc7q5ffhX16lWVVsPsz8JkTHf9WyBIk=
X-TOR-Router: sha256:MmEwZTplNzAxOjExOTg6OjE= --
X-Notice: Filtered by postfilter v. 0.9.3
 by: SugarBug - Wed, 7 Feb 2024 06:04 UTC

No matter what I do Thunderbird will not work with rslight ssl with
self-signed certificate. Manually adding the cert in Thunderbird does
not fix it.

I tried to fix it at the server level with letsencrypt.inc.php.

I enabled letsencrypt by renaming the .dist file. I entered the path to
the desired key directory.

When cron runs no keys are generated in the path.

Errors are output in syslog with full path <snippped>:

2024-02-07T00:52:41.940136-05:00 lamp php[6367]: PHP Fatal error:
Uncaught TypeError: openssl_pkey_get_details(): Argument #1 ($key) must
be of type OpenSSLAsymmetricKey, bool given in
<snip>/config/letsencrypt.inc.php:12

2024-02-07T00:52:41.940357-05:00 lamp php[6367]: #0
<snip>/config/letsencrypt.inc.php(12): openssl_pkey_get_details()

2024-02-07T00:52:41.940517-05:00 lamp php[6367]: thrown in
<snip>/config/letsencrypt.inc.php on line 12

Then I manually created the key directory and still got the same
errors. User has read and write permissions.

Then I changed the directory in letsencrypt.inc.php to use existing keys
for my domain and the cron returned the same errors.

What am I missing?

--
SugarBug <3883@sugar.bug> | sybershock.com

Re: [rslight] thunderbird and letsencrypt problems

<b46e490a9f9f7f68129e37fd38d6f3bb@www.novabbs.org>

  copy mid

https://news.novabbs.org/computers/article-flat.php?id=951&group=rocksolid.nodes.help#951

  copy link   Newsgroups: rocksolid.nodes.help
Date: Wed, 7 Feb 2024 16:38:20 +0000
Subject: Re: [rslight] thunderbird and letsencrypt problems
From: retro.guy@rocksolidbbs.com (Retro Guy)
Newsgroups: rocksolid.nodes.help
X-Rslight-Site: $2y$10$XqRPV3pEvKH0hvPpvi2hGelwl2g9qWkIly0DZsX5g8btw.KlNQlgS
X-Rslight-Posting-User: a93aefeeff923def71455caae2dbfb277a59e046
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <upv6c2$2bt92$1@paganini.bofh.team>
Organization: Rocksolid Light
Message-ID: <b46e490a9f9f7f68129e37fd38d6f3bb@www.novabbs.org>
X-Face: .&YR-G(w(DZ$$,}%k=]*5*!p'=(anr"IT`wZG'2VWdfl\r)l[42u7JH`n(JUQ*e5*A|XCDf
?&\X&uwkl38"CYX3O8m}C8E4p'%N$2#kSTVzx{Ly|DjLT\Vk7NE}NQ(VC$Yq]i:7|z[.9iv^g>*8_B
H0=hZt'[%)4kG|
 by: Retro Guy - Wed, 7 Feb 2024 16:38 UTC

SugarBug wrote:

> No matter what I do Thunderbird will not work with rslight ssl with
> self-signed certificate. Manually adding the cert in Thunderbird does
> not fix it.

> I tried to fix it at the server level with letsencrypt.inc.php.

Not sure if you're using a self-signed cert or letsencrypt.

If you DO NOT have letsencrypt.inc.php (leave it with '.dist') rslight should create a self-signed cert. I just tried it on a test site and then tested it with (rslight.rtm is my local test site):
openssl s_client -connect rslight.rtm:563

<snip>
Verify return code: 18 (self-signed certificate)
Extended master secret: yes
---
200 Rocksolid Light NNTP Server ready (no posting)

> I enabled letsencrypt by renaming the .dist file. I entered the path to
> the desired key directory.

To use letsencrypt, first obtain a letsencrypt cert:
https://letsencrypt.org/

My sites use letsencrypt certs for the nntp server (novabbs.com, etc.)

Then configure letsencrypt.inc.php to point to the cert files, making sure your web user can read them. If it can not, you'll need to copy them somewhere else to read them (which is what I do for inn).

> When cron runs no keys are generated in the path.

The keys in $letsencrypt['path'] are not generated by rslight, they are generated when installing a letsencrypt cert.

Try testing with the openssl command above.

--
Retro Guy

Re: [rslight] thunderbird and letsencrypt problems

<uq1ma4$2k6s1$1@paganini.bofh.team>

  copy mid

https://news.novabbs.org/computers/article-flat.php?id=952&group=rocksolid.nodes.help#952

  copy link   Newsgroups: rocksolid.nodes.help
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!paganini.bofh.team!tor-network!not-for-mail
From: 3883@sugar.bug (SugarBug)
Newsgroups: rocksolid.nodes.help
Subject: Re: [rslight] thunderbird and letsencrypt problems
Date: Wed, 7 Feb 2024 22:48:43 -0600
Organization: To protect and to server
Message-ID: <uq1ma4$2k6s1$1@paganini.bofh.team>
References: <upv6c2$2bt92$1@paganini.bofh.team>
<b46e490a9f9f7f68129e37fd38d6f3bb@www.novabbs.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Thu, 8 Feb 2024 04:45:57 -0000 (UTC)
Injection-Info: paganini.bofh.team; logging-data="2759553"; posting-host="UsdsZiYKRHXfHJF8iqyOmA.user.paganini.bofh.team"; mail-complaints-to="usenet@bofh.team"; posting-account="9dIQLXBM7WM9KzA+yjdR4A";
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha256:hn1XZ+/YFUn0yGGqpy/EhRe3Q8chsy2w4yx4NPT+r9s=
X-Notice: Filtered by postfilter v. 0.9.3
X-TOR-Router: sha256:MmEwYjpmNGMwOjE2Yzo1Ojox --
Content-Language: en-US
 by: SugarBug - Thu, 8 Feb 2024 04:48 UTC

On 2/7/24 10:38, Retro Guy wrote:
> SugarBug wrote:
>
>> No matter what I do Thunderbird will not work with rslight ssl with
>> self-signed certificate. Manually adding the cert in Thunderbird does
>> not fix it.
>
>> I tried to fix it at the server level with letsencrypt.inc.php.
>
> Not sure if you're using a self-signed cert or letsencrypt.
>
> If you DO NOT have letsencrypt.inc.php (leave it with '.dist') rslight
> should create a self-signed cert. I just tried it on a test site and
> then tested it with (rslight.rtm is my local test site):
> openssl s_client -connect rslight.rtm:563
>
> <snip>
>    Verify return code: 18 (self-signed certificate)
>    Extended master secret: yes
> ---
> 200 Rocksolid Light NNTP Server ready (no posting)

Yeah, the self-signed certs work. I originally assumed that the
letsencrypt function registered with letsencrypt API.

>> I enabled letsencrypt by renaming the .dist file. I entered the path to
>> the desired key directory.
>
> To use letsencrypt, first obtain a letsencrypt cert:
> https://letsencrypt.org/

I already have letsencrypt TLS certs for the domain.

> My sites use letsencrypt certs for the nntp server (novabbs.com, etc.)
>
> Then configure letsencrypt.inc.php to point to the cert files, making
> sure your web user can read them. If it can not, you'll need to copy
> them somewhere else to read them (which is what I do for inn).

Which of the cert files should I be using? Letsencrypt always generates
4 of them, and not in PEM format.

>> When cron runs no keys are generated in the path.
>
> The keys in $letsencrypt['path'] are not generated by rslight, they are
> generated when installing a letsencrypt cert.
>
> Try testing with the openssl command above.

Certbot, acme, and letsencrypt do not appear to generate certificates in
the PEM format usable by rslight. Also, openssl x509 -out does not
convert any of them to a proper RSA certificate recognized by rslight.
What are you using for generating the letsencrypt versions that work?

--
SugarBug <3883@sugar.bug> | sybershock.com

Re: [rslight] thunderbird and letsencrypt problems

<f3e04c9597c89e76109a1260ab10a97a@www.novabbs.org>

  copy mid

https://news.novabbs.org/computers/article-flat.php?id=953&group=rocksolid.nodes.help#953

  copy link   Newsgroups: rocksolid.nodes.help
Date: Thu, 8 Feb 2024 18:21:38 +0000
Subject: Re: [rslight] thunderbird and letsencrypt problems
From: retro.guy@rocksolidbbs.com (Retro Guy)
Newsgroups: rocksolid.nodes.help
X-Rslight-Site: $2y$10$/Q.RLYeYP9mUfGUC6XiXTO5MZQVyXGH.U.Q7ZQsmuKNp/VkahuiJ.
X-Rslight-Posting-User: a93aefeeff923def71455caae2dbfb277a59e046
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <upv6c2$2bt92$1@paganini.bofh.team> <b46e490a9f9f7f68129e37fd38d6f3bb@www.novabbs.org> <uq1ma4$2k6s1$1@paganini.bofh.team>
Organization: Rocksolid Light
Message-ID: <f3e04c9597c89e76109a1260ab10a97a@www.novabbs.org>
X-Face: .&YR-G(w(DZ$$,}%k=]*5*!p'=(anr"IT`wZG'2VWdfl\r)l[42u7JH`n(JUQ*e5*A|XCDf
?&\X&uwkl38"CYX3O8m}C8E4p'%N$2#kSTVzx{Ly|DjLT\Vk7NE}NQ(VC$Yq]i:7|z[.9iv^g>*8_B
H0=hZt'[%)4kG|
 by: Retro Guy - Thu, 8 Feb 2024 18:21 UTC

SugarBug wrote:

> On 2/7/24 10:38, Retro Guy wrote:
>> SugarBug wrote:
>>
>>> No matter what I do Thunderbird will not work with rslight ssl with
>>> self-signed certificate. Manually adding the cert in Thunderbird does
>>> not fix it.
>>
>>> I tried to fix it at the server level with letsencrypt.inc.php.
>>
>> Not sure if you're using a self-signed cert or letsencrypt.
>>
>> If you DO NOT have letsencrypt.inc.php (leave it with '.dist') rslight
>> should create a self-signed cert. I just tried it on a test site and
>> then tested it with (rslight.rtm is my local test site):
>> openssl s_client -connect rslight.rtm:563
>>
>> <snip>
>>    Verify return code: 18 (self-signed certificate)
>>    Extended master secret: yes
>> ---
>> 200 Rocksolid Light NNTP Server ready (no posting)

> Yeah, the self-signed certs work. I originally assumed that the
> letsencrypt function registered with letsencrypt API.

>>> I enabled letsencrypt by renaming the .dist file. I entered the path to
>>> the desired key directory.
>>
>> To use letsencrypt, first obtain a letsencrypt cert:
>> https://letsencrypt.org/

> I already have letsencrypt TLS certs for the domain.

>> My sites use letsencrypt certs for the nntp server (novabbs.com, etc.)
>>
>> Then configure letsencrypt.inc.php to point to the cert files, making
>> sure your web user can read them. If it can not, you'll need to copy
>> them somewhere else to read them (which is what I do for inn).

> Which of the cert files should I be using? Letsencrypt always generates
> 4 of them, and not in PEM format.

Strange. Here is what letsencrypt creates on my sites:
ls /etc/letsencrypt/live/<domain>/
cert.pem chain.pem fullchain.pem privkey.pem README

>>> When cron runs no keys are generated in the path.

Keys should end up in <spooldir>/ssl
$ssldir = $spooldir . '/ssl/';

>> The keys in $letsencrypt['path'] are not generated by rslight, they are
>> generated when installing a letsencrypt cert.
>>
>> Try testing with the openssl command above.

> Certbot, acme, and letsencrypt do not appear to generate certificates in
> the PEM format usable by rslight. Also, openssl x509 -out does not
> convert any of them to a proper RSA certificate recognized by rslight.
> What are you using for generating the letsencrypt versions that work?

The certs are generated in rslight-lib.php, and called from cron.php as:
$pemfile = $ssldir . '/server.pem';
create_node_ssl_cert($pemfile);

This requires a file to be created in <config_dir> temporarily by the web user. I suspect this may be an issue and we should change that.

Try manually creating the file:
<config_dir>/ssl.reload

as a test. (Delete it when you're done). This file would automatically be created in rslight-lib.php, but maybe that's not working. It tells rslight to re-create the ssl cert in <spooldir>/ssl

If your letsencrypt files are not .pem, are they still a format that can be used to create ssl cert?

Rslight wants to create the following three files from letsencrypt cert:
file_put_contents($pemfile, $letsencrypt['server.pem'] . $letsencrypt['privkey']);
file_put_contents($pubkeyfile, $letsencrypt['pubkey.pem']);
file_put_contents($pubkeytxtfile, $letsencrypt['pubkey.pem']);

--
Retro Guy

Re: [rslight] thunderbird and letsencrypt problems

<6471c5f326a99954831fb6fce0b2c9e3@www.novabbs.org>

  copy mid

https://news.novabbs.org/computers/article-flat.php?id=954&group=rocksolid.nodes.help#954

  copy link   Newsgroups: rocksolid.nodes.help
Date: Thu, 8 Feb 2024 20:04:17 +0000
Subject: Re: [rslight] thunderbird and letsencrypt problems
From: retro.guy@rocksolidbbs.com (Retro Guy)
Newsgroups: rocksolid.nodes.help
X-Rslight-Site: $2y$10$8VbCEWuPpoaC7IZ5chZhLOi3AlXjJHFsQKVeXbnMcrStIT9f1354u
X-Rslight-Posting-User: a93aefeeff923def71455caae2dbfb277a59e046
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
User-Agent: Rocksolid Light
References: <upv6c2$2bt92$1@paganini.bofh.team> <b46e490a9f9f7f68129e37fd38d6f3bb@www.novabbs.org> <uq1ma4$2k6s1$1@paganini.bofh.team> <f3e04c9597c89e76109a1260ab10a97a@www.novabbs.org>
Organization: Rocksolid Light
Message-ID: <6471c5f326a99954831fb6fce0b2c9e3@www.novabbs.org>
X-Face: .&YR-G(w(DZ$$,}%k=]*5*!p'=(anr"IT`wZG'2VWdfl\r)l[42u7JH`n(JUQ*e5*A|XCDf
?&\X&uwkl38"CYX3O8m}C8E4p'%N$2#kSTVzx{Ly|DjLT\Vk7NE}NQ(VC$Yq]i:7|z[.9iv^g>*8_B
H0=hZt'[%)4kG|
 by: Retro Guy - Thu, 8 Feb 2024 20:04 UTC

Retro Guy wrote:

> SugarBug wrote:

>> On 2/7/24 10:38, Retro Guy wrote:
>>> SugarBug wrote:

<snip>

>> Certbot, acme, and letsencrypt do not appear to generate certificates in
>> the PEM format usable by rslight. Also, openssl x509 -out does not
>> convert any of them to a proper RSA certificate recognized by rslight.
>> What are you using for generating the letsencrypt versions that work?

> The certs are generated in rslight-lib.php, and called from cron.php as:
> $pemfile = $ssldir . '/server.pem';
> create_node_ssl_cert($pemfile);

> This requires a file to be created in <config_dir> temporarily by the web user. I suspect this may be an issue and we should change that.

> Try manually creating the file:
> <config_dir>/ssl.reload

> as a test. (Delete it when you're done). This file would automatically be created in rslight-lib.php, but maybe that's not working. It tells rslight to re-create the ssl cert in <spooldir>/ssl

I've moved this file to <spooldir> instead of <config_dir> in the latest commit.

--
Retro Guy


computers / Rocksolid Nodes Help / Re: [rslight] thunderbird and letsencrypt problems

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor