SSL certificate / HTTPS issue using Thin rack ruby server

1
votes

I have some troubles using Thin rack Ruby server (https://github.com/macournoyer/thin) to receice HTTPS webhooks.

Maybe that's not exactly a problem related specifically to Thin but to SSL certificates configuration.

I'd like to manage incoming HTTPS connections (webhooks: Telegram.org server call my Thin (sinatra/rack) app, sending messages updates through webhooks)

Step 1. I created a SSL KEY and PEM files self-signed certificate, as described here: https://core.telegram.org/bots/self-signed

openssl req -newkey rsa:2048 -sha256 -nodes -keyout YOURPRIVATE.key -x509 -days 365 -out 
YOURPUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE"

Step 2. I call Telegram Server Bot API to receive webhooks at a specified HTTPS host/path, as described here: https://core.telegram.org/bots/api#setwebhook API endpoint return success.

Step 3. I run Thin with these parameters:

bundle exec thin start --ssl --ssl-key-file ~/.ssl/YOURPRIVATE.key --ssl-cert-file ~/.ssl/YOURPUBLIC.pem --rackup /myhome/handyBOTS/rackup/handler.ru --address xxx.xxx.xxx.xxx      --port 8443  --environment production
Thin web server (v1.6.4 codename Gob Bluth)
...
...
...

I have troubles in runt-time: I see Telegram remote server call the Thin sever webhooks, but Thin complain with laconic:

<SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp><SSL_incomp>

So I'm confident that Thin server receives calls from remote Telegram Server but it doesn't process requestes. I presume that's some SSL configuration incongruence.

Any idea ?

My specific question is:

Which is the CRT file format Thin expects ?

It's correct to pass to Thin the PEM file with this command line parameter --ssl-cert-file ~/.ssl/YOURPUBLIC.pem ?

UPDATE: The problem is possibly not related to Thin but to some certificates chain/bundle configuration, see also: Telegram Bot API Webhooks Self-signed Certificate issue

Thanks

giorgio

1
sslhttpsssl-certificatethinwebhooks

1 Answers

0
votes

[SOLVED]

It was my fault on building up certificate. Details:

https://github.com/solyaris/BOTServer/blob/master/wiki/usage.md#step-4-create-self-signed-certificate

I no more tested thin SSL configuration (I have to), because I decided that's better to leave SSL /firewall/proxy work to NGINX, using Thin instance(s) as worker(s) behind:

https://github.com/solyaris/BOTServer/blob/master/wiki/nginx.md