-1

coturn can't get access to certificates

posted 3 months ago

My certificates are in /etc/letsencrypt/live/example.com/, and when I trying to start coturn I receiving: “0: : WARNING: cannot find certificate file…” I’m interested, what is the best way to solve this problem?

Sort:

Hot Top Controversial New Old

You are viewing a single thread.

View all comments

[ - ]

hendrik@palaver.p3x.de

1 point

3 months ago

Maybe sth like usermod -a -G letsencrypt coturn which puts the coturn user in the letsencrypt group. Allowing that user access to files owned by the group. I haven’t checked the names. Maybe the group is called differently, certbot or something. Obviously that grants that coturn user access to all the certificates. You might want to set some directory permissions instead, if you have multiple certificates and don’t want coturn be able to read or mess with certificates of other domains.

permalink

report

[ - ]

someoneFromInternet@lemmy.mlOP

2 points

3 months ago

seems like I have not letsencrypt or certbot group

permalink

report

parent

[ - ]

hendrik@palaver.p3x.de

2 points

3 months ago

So who owns the certificate files then? It’s got to be some user and group?! Usually certbot is set up in some way to fetch and renew the certificates periodically. You might want to take the other advice and check the file permissions first and find out who owns them.

permalink

report

parent

[ - ]

someoneFromInternet@lemmy.mlOP

2 points

3 months ago

root owns all certificates

permalink

report

parent

[ - ]

Oisteink@feddit.nl

3 points

3 months ago

either create a cert group and give that group permission to the certs, or add a handler to distribute the cert+key on renew to your service’s folder, and change owner/group to whats relevant to the service

Note: the “live” folder only contains links to the archive folder

permalink

report

parent

[ - ]

someoneFromInternet@lemmy.mlOP

2 points

3 months ago

-rw-rwxr-- 1 root certgroup 2864 Jul 14 01:07 fullchain1.pem
-rw-rwxr-- 1 root certgroup  241 Jul 14 01:07 privkey1.pem

What if I have such permissions, but coturn still can’t access to files?

permalink

report

parent

[ - ]

hendrik@palaver.p3x.de

2 points

3 months ago

First of all you’d need to make sure that coturn is in the “certgroup” group. Or it won’t help.

Secondly, those are just the two files. “certgroup” might still be unable to open them if the directory permissions don’t allow opening the directory in the first place. And we can’t tell from just the two lines. Make sure all the parent directories also allow traversing to that location. “rX” are required to read and open a directory.

However text files shouldn’t have execute permissions. And you’ve set “rwx” for the group. That doesn’t break anything, but “rw-” would be the 100% correct choice there. And other accounts shouldn’t have read permissions on the private key. That should be “rw-rw----”

(I’m not sure why you have to do all of that stuff manually… Lot’s of frameworks or operating systems come with letsencrypt/certbot and some sane default settings. If your way of doing things doesn’t work out, you might want to read a tutorial for your operating system or consider a more standard approach.)

permalink

report

parent

Show more comments

Selfhosted

!selfhosted@lemmy.world

Create post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

Community stats

4.8K
Monthly active users
3.5K
Posts
79K
Comments

Community stats

Community moderators