skip to Main Content

I am trying to install BigBlueButton on my home server running under Ubuntu 20.04 with the following command:

$ sudo ./bbb-install.sh -w -v focal-270 -s bigbluebutton.mycustomdomain.org

I have already valid Lets’Encrypt SSL certificate for my domain bigbluebutton.mycustomdomain.org.

Not sure that I should post the whole output of the command above but I tried -e, -x, -d (with my certificate files symlinked to /local/certs) options (separately) and without these options. Each time I got the same result:

# Potential problems described below
curl: (60) SSL: no alternative certificate subject name matches target host name 'bigbluebutton.mycustomdomain.org'
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
.curl: (60) SSL: no alternative certificate subject name matches target host name 'bigbluebutton.mycustomdomain.org'
More details here: https://curl.haxx.se/docs/sslcerts.html

When I open https://bigbluebutton.mycustomdomain.org in the browser I get nginx default welcome page (or one of my other sites configured with nginx) with a message that SSL certificate is not valid because it’s related to another domain.

This is nginx configuration file /etc/nginx/sites-available/bigbluebutton generated by installation script (and linked from /etc/nginx/sites-enabled/bigbluebutton):

server_tokens off;

server {
  listen 80;
  listen [::]:80;
  server_name bigbluebutton.mycustomdomain.org;

  location ^~ / {
    return 301 https://$server_name$request_uri; #redirect HTTP to HTTPS
  }

  location ^~ /.well-known/acme-challenge/ {
    allow all;
    default_type "text/plain";
    root /var/www/bigbluebutton-default/assets;
  }

  location = /.well-known/acme-challenge/ {
    return 404;
  }
}

set_real_ip_from 127.0.0.1;
real_ip_header proxy_protocol;
real_ip_recursive on;
server {
  # this double listenting is intended. We terminate SSL on haproxy. HTTP2 is a
  # binary protocol. haproxy has to decide which protocol is spoken. This is
  # negotiated by ALPN.
  #
  # Depending on the ALPN value traffic is redirected to either port 82 (HTTP2,
  # ALPN value h2) or 81 (HTTP 1.0 or HTTP 1.1, ALPN value http/1.1 or no value)

  listen 127.0.0.1:82 http2 proxy_protocol;
  listen [::1]:82 http2;
  listen 127.0.0.1:81 proxy_protocol;
  listen [::1]:81;
  server_name bigbluebutton.mycustomdomain.org;

  # nginx does not know its external port/protocol behind haproxy, so use relative redirects.
  absolute_redirect off;
    
  # HSTS (uncomment to enable)
  #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

  access_log  /var/log/nginx/bigbluebutton.access.log;

  # This variable is used instead of $scheme by bigbluebutton nginx include
  # files, so $scheme can be overridden in reverse-proxy configurations.
  set $real_scheme "https";

  # BigBlueButton landing page.
  location / {
    root   /var/www/bigbluebutton-default/assets;
    try_files $uri @bbb-fe;
  }

  # Include specific rules for record and playback
  include /etc/bigbluebutton/nginx/*.nginx;
}

I am not nginx expert but putting configuration of my SSL certificate into this file (as I usually do for other sites) obviously don’t work:

ssl_certificate /etc/letsencrypt/live/bigbluebutton.mycustomdomain.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/bigblugbutton.mycustomdomain.org/privkey.pem;

I think the reason is that there is no server block for 443 port used for https connection. I also noted include /etc/bigbluebutton/nginx/*.nginx; at the end of the file but it seems that is not related to server host configuration.

So my question is: how to configure BigBlueButton properly to accept my (existing) SSL certificate?

2

Answers


  1. @ezze

    ok pls notice this in BBB 2.7, i found this after researching the source code

    Certificate path: 
    
    /etc/haproxy/certbundle.pem
    
    Pls combine your custom certificate to "certbundle.pem"
    1.chain=intermediate+root 
    2.fullchain=cert+chain
    3.certbundle=fullchain+privatekey
    
    Login or Signup to reply.
  2. after you put certificate files in below path
    /etc/haproxy/certbundle.pem
    you should restart haproxy and then bbb-conf –check works fine

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search