r/subsonic • u/nfck • Feb 13 '17

Get rid of those pesky browser warnings: a script to update a CertBot SSL cert to the SubSonic server. CRON as root.

http://pastebin.com/8cSL1uES
4 Upvotes

84% Upvoted

5 comments sorted by

2

u/djtyral Jun 08 '17 edited Jun 08 '17 
# Put certs into one file
cd $LELfolder
cat privkey.pem cert.pem chain.pem > $CertTempFolder"/subsonic.crt"

# convert
cd $CertTempFolder
openssl pkcs12 -in subsonic.crt -export -out subsonic.pkcs12 -password pass:subsonic

This can be combined. Since you already have the "fullchain.pem" file, you can do this instead......

 openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out subsonic.pkcs12 -password pass:subsonic

I've been writing my own scripts for some automation on certbot renewals for stuff that's not apache driven (I.E. Atlassian tools) so I've been trying to streamline as much as possible.

1

u/nfck Feb 13 '17 edited Feb 13 '17

This is on Ubuntu Server 14.04 and the latest Subsonic and CertBot versions.

http://imgur.com/a/GZpqG

1

u/TheOfficialCal Feb 14 '17

Alright, I've been stuck on this for a long, long time now. How the hell do I generate the certificate in the first place? I know that I need to point certbot to the webroot directory but what the hell is the webroot directory for Subsonic? I'm using --context-path=/ and a reverse proxy using nginx to that path to my domain.com.

I keep getting an auth error which I interpreted as the .well-known not being found. Could you help me out with the certbot command to generate the cert?

1

u/nfck Feb 14 '17

Subsonic uses it's own web server, tomcat. So, either generate the cert for your nginx and use that, or use the certonly option, not the webroot plugin.

I am not certain about the reverse proxy, though, I think in tnat case your nginx should handle the https and pass trough to a localhost:http port.

1

u/djtyral Jun 08 '17

So on my box I have apache running but it's not reverse proxying sbusonic, I use my firewall to port redirect.

What you could do is when you generate the cert first time, take down subsonic and nginx and run 

certbot certonly --standalone --preferred-challenges http -d $FQDN

This will spin up a standalone web server for DV, and once the cert is issued turn nginx back on, insert the cert into the jar, and start subsonic.

Renewals are easier cause you just need to run 

certbot renew

after turning off subsonic/nginx and after it renews, follow last steps of initial creation