Telegram Bot API Webhooks Self-signed Certificate issue

Question

I'm working on a Ruby language server to manage multiple Telegram Bots via setwebhooks

BTW, I'll delivery the server as opensource at BOTServer

PROBLEM

I have troubles receiving webhook updates from Telegram Bot API Server. I have set a webhook token (Telegram reply "success") but I do not receive any update on the succesfully configured webhook.

I think the problem could be around self-signed Certificate mysteries. See old reddit question and answers.

I have similar problem and I fair the point is in some "misunderstanding" between Telegram Bot API Server that send HTTPs webhooks updates and the bot server receving webhooks (I use nginx as proxy/https SSL certificate handler).

It seems that someone solved the issue configuring nginx with a certificate "chain"; I'm pretty ingnorant in certificates tricks and so I ask:

QUESTION

May someone can post info, to configure nginx (any ssl web server!) with detailed settings / step-by step for dummies, showing how to pass from .key and .pem files described here: https://core.telegram.org/bots/self-signed to set-up the certificate "chain" to configure in nginx config, to be "accepted" by Telegram Bot API Server ?

BTW, my nginx config now:

upstream backend {
  server 127.0.0.1:3000;
}

#
# HTTPS server
#
server {
  listen 8443 ssl;
  server_name myhost.com;

  ssl on;
  ssl_certificate /mypath/ssl/PUBLIC.pem;
  ssl_certificate_key /mypath/ssl/PRIVATE.key;

  ssl_session_timeout 5m;

  ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
  ssl_prefer_server_ciphers on;

  location @backend {
    proxy_pass http://backend;
  }

  location / {
    try_files $uri @backend;
  }
}

where PRIVATE.key + PUBLIC.pem files are that one generated following guidelines: Using self-signed certificates:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout PRIVATE.key -x509 -days 365 -out PUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE"

thanks

giorgio

Answer 1

I answer myself, to share solution found here: https://stackoverflow.com/a/33260827/1786393

the point was not the mentioned nginx configuration, but the PEM file:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout YOURPRIVATE.key -x509 -days 365 -out YOURPUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE"

YOURDOMAIN.EXAMPLE in the subj strig of openssl must be real hostname of your server that receive webhooks.

Answer 2

the solution that works for me:

I generated key pairs: openssl genrsa -out webhook_pkey.pem 2048 and openssl req -new -x509 -days 3650 -key webhook_pkey.pem -out webhook_cert.pem

don't forget to give FQDN name. give your host's ip at least

added it to nginx config

server {
    listen      8443 ssl;
    server_name MY_IP;
    charset     utf-8;
    client_max_body_size 75M;
    ssl_certificate /var/www/myproject/tg_keys/webhook_cert.pem;
    ssl_certificate_key /var/www/myproject/tg_keys/webhook_pkey.pem;

    location / { try_files $uri @yourapplication; }
    location @yourapplication {
        include uwsgi_params;
        uwsgi_pass unix:/var/www/myproject/hb.sock;
    }
}

Answer 3

cURL options:

    CURLOPT_SSL_VERIFYPEER = false
    CURLOPT_SSL_VERIFYHOST = false