Errror with Le'ts Encrypt SSL Certificates

[xpilgrim]

Hi, I'm trying to use EPL with Let's Encrypt SSL certificate.
In order to running EPL not as root, I've copied my certificates and changed the ownership, so that EPL can read it. But maybe, thats not the right way? It gives me:

Error: error:0906D06C:PEM routines:PEM_read_bio:no start line

Could the reason can be, that I've copied the tree files out of the Let's Encrypt folder?

My config part is:

"ssl" : {
            "key"  : "/opt/etherpad/ssl-key/fullchain.pem",
            "cert" : "/opt/etherpad/ssl-key/cert.pem",
            "ca": ["/opt/etherpad/ssl-key/chain.pem", "/opt/etherpad/ssl-key/fullchain.pem"]

          },

But, pointing I the cert path to the original, I'm getting this expected error:
Error: EISDIR: illegal operation on a directory, read

With apache, my certificate is working well.

Where is my mistake?

Etherpad version is 1.6.6 (599b1f4)
node -v v10.5.0

[Wikinaut]

I suggest you run etherpad under/as user "etherpaduser", and make the etherpad directory (and subdirectories) and the ssl keys accessible to that user. This will work then.

[xpilgrim]

Hm, I think, that's already the case:

sudo ls -la /opt/etherpad

drwxr-xr-x 7 etherpad etherpad 4096 Jul  4 10:00 .
drwxr-xr-x 3 root     root     4096 Jun 28 10:28 ..
-rw------- 1 etherpad etherpad  332 Jun 28 13:28 .bash_history
drwx------ 3 etherpad etherpad 4096 Jun 28 10:30 .config
drwxrwxr-x 9 etherpad etherpad 4096 Jul  4 11:03 etherpad-lite
drwxrwxr-x 2 etherpad etherpad 4096 Jun 28 10:48 .nano
drwxrwxr-x 5 etherpad etherpad 4096 Jun 28 10:30 .npm
drwxrwxr-x 2 etherpad etherpad 4096 Jul  4 10:38 ssl-key

the copied ssl key

sudo ls -la /opt/etherpad/ssl-key
total 20
drwxrwxr-x 2 etherpad etherpad 4096 Jul  4 10:38 .
drwxr-xr-x 7 etherpad etherpad 4096 Jul  4 10:00 ..
-rw-r--r-- 1 etherpad etherpad 2187 Jul  4 10:02 cert.pem
-rw-r--r-- 1 etherpad etherpad 1647 Jul  4 10:38 chain.pem
-rw-r--r-- 1 etherpad etherpad 3834 Jul  4 10:02 fullchain.pem

[Adorfer]

i would highly recommend to put nginx as reverse-proxy in front, for performance reasons.
this then can deal with the ssl as well.

[rlegene]

Why would adding more processing make the performance better? Also, I would highly discourage unwrapping SSL before its final destination, for privacy reasons (internal networks are not secure).

[Wikinaut]

@xpilgrim set the *.pem permissions to -r-------- 1 etherpad etherpad and place the *.pem in your etherpad "root" directory.

So, in other words, don't use a subdirectory. Works for me.

[Adorfer]

@rlegene: because nginx does do some good caching as reverse proxy.
the security aspect: There are no user logins on the host. and etherpads listens only on ::1

[muxator]

Can this be closed?

[xpilgrim]

Sorry for the delay. I havn't figured out this issue.
But for a while, I'm using EPL with the MyPads PlugIn and the ssl settings for apache.
This works for me.