I am trying to install BigBlueButton on my home server running under Ubuntu 20.04 with the following command:
$ sudo ./bbb-install.sh -w -v focal-270 -s bigbluebutton.mycustomdomain.org
I have already valid Lets’Encrypt SSL certificate for my domain bigbluebutton.mycustomdomain.org
.
Not sure that I should post the whole output of the command above but I tried -e
, -x
, -d
(with my certificate files symlinked to /local/certs
) options (separately) and without these options. Each time I got the same result:
# Potential problems described below
curl: (60) SSL: no alternative certificate subject name matches target host name 'bigbluebutton.mycustomdomain.org'
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
.curl: (60) SSL: no alternative certificate subject name matches target host name 'bigbluebutton.mycustomdomain.org'
More details here: https://curl.haxx.se/docs/sslcerts.html
When I open https://bigbluebutton.mycustomdomain.org in the browser I get nginx default welcome page (or one of my other sites configured with nginx) with a message that SSL certificate is not valid because it’s related to another domain.
This is nginx configuration file /etc/nginx/sites-available/bigbluebutton
generated by installation script (and linked from /etc/nginx/sites-enabled/bigbluebutton
):
server_tokens off;
server {
listen 80;
listen [::]:80;
server_name bigbluebutton.mycustomdomain.org;
location ^~ / {
return 301 https://$server_name$request_uri; #redirect HTTP to HTTPS
}
location ^~ /.well-known/acme-challenge/ {
allow all;
default_type "text/plain";
root /var/www/bigbluebutton-default/assets;
}
location = /.well-known/acme-challenge/ {
return 404;
}
}
set_real_ip_from 127.0.0.1;
real_ip_header proxy_protocol;
real_ip_recursive on;
server {
# this double listenting is intended. We terminate SSL on haproxy. HTTP2 is a
# binary protocol. haproxy has to decide which protocol is spoken. This is
# negotiated by ALPN.
#
# Depending on the ALPN value traffic is redirected to either port 82 (HTTP2,
# ALPN value h2) or 81 (HTTP 1.0 or HTTP 1.1, ALPN value http/1.1 or no value)
listen 127.0.0.1:82 http2 proxy_protocol;
listen [::1]:82 http2;
listen 127.0.0.1:81 proxy_protocol;
listen [::1]:81;
server_name bigbluebutton.mycustomdomain.org;
# nginx does not know its external port/protocol behind haproxy, so use relative redirects.
absolute_redirect off;
# HSTS (uncomment to enable)
#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
access_log /var/log/nginx/bigbluebutton.access.log;
# This variable is used instead of $scheme by bigbluebutton nginx include
# files, so $scheme can be overridden in reverse-proxy configurations.
set $real_scheme "https";
# BigBlueButton landing page.
location / {
root /var/www/bigbluebutton-default/assets;
try_files $uri @bbb-fe;
}
# Include specific rules for record and playback
include /etc/bigbluebutton/nginx/*.nginx;
}
I am not nginx expert but putting configuration of my SSL certificate into this file (as I usually do for other sites) obviously don’t work:
ssl_certificate /etc/letsencrypt/live/bigbluebutton.mycustomdomain.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/bigblugbutton.mycustomdomain.org/privkey.pem;
I think the reason is that there is no server
block for 443 port used for https connection. I also noted include /etc/bigbluebutton/nginx/*.nginx;
at the end of the file but it seems that is not related to server host configuration.
So my question is: how to configure BigBlueButton properly to accept my (existing) SSL certificate?
2
Answers
@ezze
ok pls notice this in BBB 2.7, i found this after researching the source code
after you put certificate files in below path
/etc/haproxy/certbundle.pem
you should restart haproxy and then bbb-conf –check works fine