Telegram Bot API Webhooks Self-Signing Certification

Question

I work on a Ruby language server to manage multiple Telegram bots through setwebhooks

BTW, I will put the server as openource in BOTServer

PROBLEM

I'm having problems getting webhook updates from Telegram Bot API Server. I set the webhook token ("Telegram Response Success"), but I am not getting any update on a successfully configured website.

I think the problem may be around the self-signed certificate of secrets. See the old reddit question and answers.

I have a similar problem and I am fair that there is some “misunderstanding” between the Telegram Bot API Server, which sends HTTP website updates and bot server receive websites (I use nginx as a proxy / https- SSL certificate).

It seems that someone has solved the problem with configuring nginx with a chain certificate; I rather disdain certificate tricks, and therefore I ask:

Question

Maybe someone can post information, configure nginx (any ssl web server!) With detailed settings / step by step for mannequins, showing how to go from the .key and .pem files described here: https: //core.telegram .org / bots / self-signed to configure the certificate chain to configure in nginx configuration to be "accepted" by Telegram Bot API Server?

BTW, now my nginx configuration:

upstream backend {
  server 127.0.0.1:3000;
}

#
# HTTPS server
#
server {
  listen 8443 ssl;
  server_name myhost.com;

  ssl on;
  ssl_certificate /mypath/ssl/PUBLIC.pem;
  ssl_certificate_key /mypath/ssl/PRIVATE.key;

  ssl_session_timeout 5m;

  ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
  ssl_prefer_server_ciphers on;

  location @backend {
    proxy_pass http://backend;
  }

  location / {
    try_files $uri @backend;
  }
}

where the PRIVATE.key + PUBLIC.pem files are the following recommendations created: Using self-signed certificates :

openssl req -newkey rsa:2048 -sha256 -nodes -keyout PRIVATE.key -x509 -days 365 -out PUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE"

thanks

Giorgio

Answer 1

, , : fooobar.com/questions/1617564/...

nginx, PEM:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout YOURPRIVATE.key -x509 -days 365 -out YOURPUBLIC.pem -subj "/C=US/ST=New York/L=Brooklyn/O=Example Brooklyn Company/CN=YOURDOMAIN.EXAMPLE"

YOURDOMAIN.EXAMPLE subj strig openssl , -.

Answer 2

, :

: openssl genrsa -out webhook_pkey.pem 2048 openssl req -new -x509 -days 3650 -key webhook_pkey.pem -out webhook_cert.pem

FQDN. IP-

nginx

server {
    listen      8443 ssl;
    server_name MY_IP;
    charset     utf-8;
    client_max_body_size 75M;
    ssl_certificate /var/www/myproject/tg_keys/webhook_cert.pem;
    ssl_certificate_key /var/www/myproject/tg_keys/webhook_pkey.pem;

    location / { try_files $uri @yourapplication; }
    location @yourapplication {
        include uwsgi_params;
        uwsgi_pass unix:/var/www/myproject/hb.sock;
    }
}

Answer 3

cURL:

    CURLOPT_SSL_VERIFYPEER = false
    CURLOPT_SSL_VERIFYHOST = false