Greenlight doesn't handle the Let's Encrypt CA switch

[trs80]

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

2021-09-30 15:22:56 +0000: ERROR: [2b415b42-8abf-4a9a-be56-cf41696fb873] BigBlueButtonException: Connection error. Your URL is probably incorrect: "https://puppis.ccgs.wa.edu.au/bigbluebutton/api". Error: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (certificate has expired)

puppis.ccgs.wa.edu.au is scalelite and has a let's encrypt certificate valid until December.

[frederic100]

Hello, try to update greenlight

cd /root/greenlight
docker-compose down
docker pull bigbluebutton/greenlight:v2
docker-compose up -d

[trs80]

Mine is slightly customised and it's midnight here, will try tomorrow. Also school holidays fortunately.

[jannooo]

Unfortunately, this isn't enough. We are still experiencing the problem after pulling the current image.

[jannooo]

Nevermind. It was a second problem that had nothing to do with it. Your suggestion does the trick.

[kusznerr]

We are experiencing exactly the same problem now. Unfortunately we are running quite a customized version of a greenlight , and cannot simply rebuild it. Do you have any idea what is the true root cause ? Is there any cert that needs to be refreshed ?

would incorporating this commit help ? https://github.com//pull/2930

[Lutice]

this problem comes from this : https://scotthelme.co.uk/lets-encrypt-old-root-expiration/
and there is a mistake in the alpine container : gliderlabs/docker-alpine#30
I tried to update manually the certificates and I have this message : WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping

[Lutice]

@kusznerr I think this patch run for the last greenlight versions, but not for the older. In the fix ruby version is 2.7 but on some greenlight ruby version is 2.5 ... and normally a pull to upgrade greenlight should be a solution

[kusznerr]

@kusznerr I think this patch run for the last greenlight versions, but not for the older. In the fix ruby version is 2.7 but on some greenlight ruby version is 2.5 ... and normally a pull to upgrade greenlight should be a solution

Yes - exactly. We are still on 2.5. Do you have idea which http client (gem) is used there ?

[ofudre]

@kusznerr
Fix for CA certificate:

apt-get install snapd
apt-get remove -y certbot
snap install certbot --classic
certbot renew --force-renewal --preferred-chain "ISRG Root X1"

tested in 8 servers ubuntu 16.04 with customized greenlight

[hiroshisuga]

Yes, @kusznerr 's trick is working. But one needs to restart nginx by
sudo systemctl restart nginx

Can we keep this "classic" setting forever?

Or should we revert it to the apt's certbot when GL is upgraded to the latest version?
If so, would the following command do the job?
snap remove certbot
apt-get install certbot
certbot renew

[kusznerr]

@kusznerr
Fix for CA certificate:

apt-get install snapd
apt-get remove -y certbot
snap install certbot --classic
certbot renew --force-renewal --preferred-chain "ISRG Root X1"

tested in 8 servers ubuntu 16.04 with customized greenlight

Thank you for all timely responces , we were playing with these across greenlight, scalelite-api and bbb servers and continued to get wrong results. As a last resort decided on getting a new wildcard cert, which after installation worked perfectly in our ecosystem. Some lessons learned on our side for sure

[sualko]

I'm experience the same issues on a customized 2.9.2 Greenlight version. Any help would be appreciated.

EDIT: To verify that I'm on Ruby 2.7, I run docker exec greenlight-v2 ruby --version and it showed me 2.5. This means there have to be an issue with my custom image.

[hiroshisuga]

To revert

snap remove certbot
apt-get install certbot
certbot renew

the last one should be with --force-renewal. And everything may have to be executed by sudo.

This thread saved my life!

[strickes]

I am on Ubuntu 18.04 and on the Ruby 2.7 Version:

docker exec greenlight-v2 ruby --version
ruby 2.7.2p137 (2020-10-01 revision 5445e04352) [x86_64-linux-musl]

unfortunately I have issues connecting to another server for OpenID Login where I get "Error 500"

I updated the ca-certificates on the main server and even forced a certificate renewal but still to no avail. This seems to correlate with the Letsencrypt problems as they occured exactly when the root certificate expired.

[belorenz]

Hello, try to update greenlight

cd /root/greenlight
docker-compose down
docker pull bigbluebutton/greenlight:v2
docker-compose up -d

Did the job for me. Thank you!