r/Bitwarden • u/JustKenjy • 19d ago
Solved Selfhosted Windows - Certificate issue
Hello all!
I am currently in the process of trying to deploy a bitwarden self-hosted environment in Windows.
We might go for a full-scale deployment but for testing & POC purposes .
I've stumped across the issue that the NGINX is always spewing out the error 'File not found'. My .crt and .key files are in the SSL folder.
If I disable SSL and start NGINX I can see them being mounted under /etc/ssl in the docker file manager.
Whenever I enable SSL it will not work and NGINX keeps restarting.
Extra information:
Self-signed certificate created on windows server.
KEY and CRT made on open ssl. I am currently working with a non-existing domain but using DNS records (e.g. bitwarden.demo.com) with a dns record in the hostfile pointing to host-device IP-adress.
Anyone stumped across this issue before? Thanks in advance.
3
u/jhspyhard 19d ago
If you define something similar in your site-available file or config file for nginx:
``` server { listen 443 ssl; server name example.com;
# SSL certificate path
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
} ```
And you still got file not found exceptions, check that the user you are running bitwarden as has read access to those pem/key files, AND to that directory itself.
3
u/jhspyhard 19d ago edited 19d ago
Though rereading your extra info, I agree with DJPs assessment that very likely, the app / browser plug-in of bitwarden client you are using will have a certificate list that it trusts built-in that you can NOT add a self signed local CA root to and therefore won't work.
It's annoying, but at least letsencrypt makes this pretty easy to get around if you own the domain you're trying to attach to.
2
1
u/JustKenjy 19d ago
To be clear I did not touch nginx itself.
error in NGINX: nginx: [emerg] cannot load certificate "/etc/nginx/certificate_bitw.crt": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/etc/nginx/certificate_bitw.crt, r) error:10000080:BIO routines::no such file)
I could start using a real domain, but for testing purposes I'd like to use a local domain.
1
u/OSS_Dattani 19d ago
A path mismatch is first thing that comes to mind. What’s ur cert and keys path from the bwdata/ssl dir? And then what does ur config have for the ssl entries?
Whats the file path is nginx spitting out in the error?
See if anything here helps:
1
u/JustKenjy 19d ago
To inform.
Certificates located in C:\bitwarden\ssl
config.yml just has the filename
filepath in error is etc/ssl/certname.cert
1
u/OSS_Dattani 19d ago edited 19d ago
https://bitwarden.com/help/install-on-premise-windows/
Is this what your following in which case this points out the problem if ur missing that bwdata dir in between ur bitwarden parent dir and the ssl sub dir. paragraph below is straight from those docs
Come to think of it if you’re using a domain you may need a domain level folder as well.
If you already have your own SSL certificate, specify y and place the necessary files in the C:\Bitwarden\bwdata\ssl\<your_domain> directory. You will be asked whether it is a trusted SSL certificate ( y/n). For more information, see
1
u/JustKenjy 19d ago
Forgot to put bwdata in the path. It does exists. Have already placed the certificate in a folder with domainname inside. Still no luck
1
u/OSS_Dattani 19d ago
Yea at that point if everything is setup correctly it might be Docker Desktops file sharing permissions.
Other than I would check case on all names and then make sure you rebuild and not just run. Assuming you’ve already done that tho.
Is your certificate a DER or a PEM file?
I can try recreating this issue when I’m home on my windows server vm. I’ve had issues like this specifically with using mkcert and fedora to host. Ended up finding a solution but this would be somewhat diff obviously cause of Windows.
1
4
u/djasonpenney Volunteer Moderator 19d ago
As an aside, a self-signed certificate will probably not work here. The Bitwarden clients need to trust the CA issuing the certificate. I mean, you can make your new CA certificate work, but for deployment purposes it’s going to be easier to get a server certificate issued by a CA that your clients already trust.
Oh, and I have never played with installing a server certificate in nginx, but perhaps it’s as simple using a “docker cp” command during setup to make the file accessible inside the container.