Mattermost letsencrypt not working

fusion44 2017-03-04 09:24:27 UTC #1

Hi!

There's no Mattermost category yet, if one is created please move this post

I've setup a Mattermost install to Google Compute engine. Everything worked very well except that I can't get nginx to use my letsencrypt SSL certificates. You can find my full config in this GIST. Note, I have replaced the standard ssl certificate path in /opt/bitnami/apps/mattermost/conf/certs/server.crt to the standard letsencrypt path. NGINX doesn't seem to recognize the certificates. Copying the certificates over to the standard files doesn't work either. I've also tried enabling SSL directly in mattermost but then NGINX can't connect to the backend anymore. The error log doesn't have any meaningfull error in it.

Any idea what the problem could be? Thanks!

fusion44 2017-03-04 10:37:20 UTC #2

For whatever reason - it works now. Maybe it was a DNS issue.

themapsmith 2017-05-14 13:57:05 UTC #3

Hey @fusion44. I'm really new to the cloud, and am having trouble getting letsencrypt setup. I run certbot --nginx on my GCP console and get a note certbot cannot find a virtualhost. I'm afraid that I'm so green in this area I have no clue where to start. Would you be willing to help me for a few minutes to get my Mattermost instance configured? Thanks

jsalmeron 2017-05-15 13:09:16 UTC #5

Hi,

I was able to make it work by doing the following:

sudo apt install git
git clone https://github.com/certbot/certbot
cd certbot
sudo ./certbot-auto certonly

And then using

2: Place files in webroot directory (webroot)

Specify the webroot of the server and it should work. Then you need to modify the certificate configuration in the nginx settings of mattermost in /opt/bitnami/apps/mattermost/conf.

Hope it helps.

Best regards,

Javier J. Salmerón

voyager529 2017-09-20 15:15:22 UTC #6

jsalmeron,

Thank you for the pointer, however, I am stuck on the same thing.

First, the MatterMost configuration seems to keep reverting back to the internal IP of the server, rather than chat.foobar.com as I keep entering. Changing the line in /home/bitnami/apps/mattermost/server/config/config.json doesn't seem to change this behavior, either.

But regardless, I'm having the same issue as the GP. I'm running the latest MatterMost build. I was hoping that getting a Let's Encrypt certificate would be as simple as enabling the option in MatterMost, but obviously not so much. So I followed the instructions posted (side note, the 'webroot' option is #3 now), but got the 400 error indicating that the traffic was being redirected to HTTPS. I disabled the option in MatterMost, and also found another website that indicated that the 'ssl on' option in the nginx config would do the same thing. So I commented the line out in /opt/bitnami/nginx/conf/vhosts/mattermost.conf (which also had the internal IP, which I changed to chat.foobar.com, then reverted on the next reboot again...), and then I got another error message...which wasn't the 400 error, but I can't seem to find in the log files and is beyond my terminal buffer and I've used up all of my 'botched attempt at getting a cert' allowances.

If we're able to figure this out, I will be more than happy to personally write the copy/paste tutorial for getting a LetsEncrypt cert for the MatterMost machine.

jota 2017-09-21 10:31:30 UTC #7

Hi @voyager529,

Did you restart the instance after setting the proper hostname? Please note that Bitnami includes a tool that changes the machine hostname in the configuration files of the application every time the machine gets booted. You will find more information about how to change the IP or hostname of the application and how to disable that tool here:

https://docs.bitnami.com/google/apps/mattermost/#updating-the-ip-address-or-hostname

This guide also explains how to generate the certificates using let's encrypt

https://docs.bitnami.com/google/components/apache/#how-to-generate-and-install-a-lets-encrypt-certificate-for-your-domain-using-the-certbot-client

Regards,
Jota

voyager529 2017-09-21 14:06:20 UTC #8

Thank you so much for your quick response, Jota!

The document provided regarding updating the hostname worked perfectly, so thank you so much for that.

I think that at least a part of the issue I'm having with the MatterMost SSL certificate is that it's not exactly clear what the HTTP root folder is for this server. The documentation provided on that front was easy to read, but also written for Apache while the Mattermost runs on nginx (I should also have probably clarified that, unlike the writer of the original post, I'm running the VMWare OVA). Naturally, the nginx documentation is rather sparse on the Let's Encrypt side of things.

Thanks!
Joey

jota 2017-09-22 11:44:32 UTC #9

Hi @voyager529,

It seems this issue was also opened in the official forum of Mattermost some time ago, could you please check it the following link?

You will find the link to the official documentation of Mattermost there. Please note that you will need to modify some paths when following it as the installation directory is different when using the Bitnami solution. Also, the commands to stop/start/restart nginx is different

installdir/ctlscript.sh restart nginx

I hope it helps.
Jota

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!