0

I have installed a zulip server and I'm having issue with server certificate.

First, when I am trying to enter through the web Chrome pop a warning about the site certification and let me choose (back to safety / add an exception).

Another issue pops when I try to sent a message through a bot (it doesn't really matter what does it mean). I get this error:

requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

On the installation guide it states:

Install SSL certs

Zulip requires HTTPS, so you need to install an SSL certificate here:
/etc/ssl/private/zulip.key
/etc/ssl/certs/zulip.combined-chain.crt

If you don't know how to generate an SSL certificate, you, you can do the following to generate a self-signed certificate:

apt-get install openssl
openssl genrsa -des3 -passout pass:x -out server.pass.key 4096
openssl rsa -passin pass:x -in server.pass.key -out zulip.key
rm server.pass.key
openssl req -new -key zulip.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey zulip.key -out zulip.combined-chain.crt
rm server.csr
cp zulip.key /etc/ssl/private/zulip.key
cp zulip.combined-chain.crt /etc/ssl/certs/zulip.combined-chain.crt

I did as I was asked (I made a self-signed certificate). Below this section there is a note:

You will eventually want to get a properly signed certificate (and note that at present the Zulip desktop app doesn't support self-signed certificates), but this will let you finish the installation process.

Maybe that's the reason for my issues?

If that's OK, I also would love to get a brief explanation about what certificate are.


EDIT: I forgot to mention that the server is running offline in a closed network. I am not sure if it has something to do with the above issues or not, but I will put it here anyway.

1 Answer 1

0

What is a (SSL/TLS) certificate? In very brief, a digital (publickey) certificate provides a way to verify that a publickey belongs to an entity such as a server, and is used to make sure that you are connecting to the legitimate server and not an imposter such as a crook or spy agency. (And the sometimes arguable distinctions between those is offtopic here.)

Although there are (and have been in the past) several kinds of digital certificates, SSL/TLS uses the kind defined by the X.509 standard and related standards like "PKIX" (Internet Public Key Infrastructure - X.509). As often, Wikipedia is good place to start: https://en.wikipedia.org/wiki/X.509 is pretty thorough (but not brief) for the certificate in itself; https://en.wikipedia.org/wiki/Certificate_authority is good on how you get a cert (or don't). (Technical nitpicks: the TLS specs allow for the possibility of using other kinds of certs, but no one actually does; they also allow the possibility of "anonymous" connections using no server certificate, but because these are generally insecure in practice most software and in particular web browsers do not allow them.)

Using a "real" certificate. Most SSL/TLS clients are set up to initially trust a set of a hundred or so "well-known" CAs like Symantec and Comodo and GoDaddy, and some government-run ones that are not so well known other than the countries they operate. The exact set varies a little across different platforms and changes over time as new CAs are established and old ones shutdown or merge or occasionally fail (e.g. DigiNotar). If you get your server certificate issued by one of these established CAs, most clients will probably accept it automatically. Important limitation: you can only get a "real" cert for a domain name that belongs to you (or multiple names that all belong to you); exactly how "belongs" is defined depends on the CA, but usually it means controlling DNS, email, and/or a public web server. If the server you want to set up uses only an internal domain (or non-domain) name or a private (rfc1918) address, as might be the case for your "closed network", you can't get a "real" cert for it.

Using a self-signed certificate. Since you have not established to all the browser and client and OS vendors that you can be trusted with the security of most of the world, your self-signed certificate is not in the default truststores of pretty much any software, so you need to add it to the truststore. How you do this varies depending on the client(s) you use. Note you should add only the certificate, as a "trusted root" or "trusted authority", NOT the privatekey; fortunately almost nothing else accepts OpenSSL-format "PEM" privatekey files. Just don't copy the privatekey anywhere besides your server (and a safe preferably offline backup if you want that).

  • IE (and I believe Edge) and Chrome/Windows use the Windows store. This can be accessed (and in particular you can add your cert) in IE from Tools/Options in Content as Certificates, in Chrome/Advanced as Manage Certficates, or directly from Control Panel - Internet under Content as Certificates.

  • Firefox (on all OS) uses its own store, accessed under Tools/Options/Advanced.

  • Chrome(ium)/Unix I don't know

  • Java: an installed JRE comes with a default cacerts file in JRE/lib/security. A Java application can override this, but not many do, so usually just adding your cert to cacerts is enough, except for the fact that installing a new JRE version resets cacerts -- and you frequently neeed to install new JRE versions because of security vulnerabilities. You can somewhat avoid this by using jssecacerts instead; set it up with the CAs you want -- probably some but not necessarily all of those in cacerts, plus your own; then save a copy of jssecacerts elsewhere and just copy it into any new JRE.

  • OpenSSL (on Unix). From the error format, your 'bot' is clearly using OpenSSL (or a fork like LibreSSL). OpenSSL itself defines a default truststore location, but does not provide any certs in it. However, many packagers of OpenSSL add a set of CA certs, often called something like 'ca-certificates' or 'pki-certs'. You don't specify an OS, but your use of apt-get suggests Debian or Ubuntu; if so I don't know what you are likely to have installed, but something involving dpkg -l, apt-cache, or aptitude might work. If so there is probably a documented process for adding your own certs to the distributed set; check your man pages.

    However OpenSSL makes it easy for an application (or middleware) to use a different truststore than the default. For example, curl is a common commandline tool that usually uses OpenSSL (though it can use other implementations) and has commandline options --cacert --capath to use a custom truststore. Depending on what your 'bot' is, it might or might not have similar or different options or none.

  • OpenSSL on Windows has in principle similar options but in practice is much more confusing. There is no single packaging system or file hierarchy on Windows as there usually is on a given Unix variant or Linux distribution, instead there are hundreds or thousands of more or less completely different methods invented by lots and lots of people. If you need this, ask a much more specific and complete question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.