Navigation

    Kopano
    • Register
    • Login
    • Search
    • Categories
    • Get Official Kopano Support
    • Recent
    Statement regarding the closure of the Kopano community forum and the end of the community edition

    kopano-kwebd running but failing while obtaining bundled SAN cert

    Kopano Meet & WebMeetings
    2
    5
    143
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • mcdaniels
      mcdaniels last edited by mcdaniels

      Hi,
      anyone had the issue, that kopano-kwebd crashes, if you try to open the URL?

      I ve configured kwebd to answer HTTPS requests on port 9443. It seems like that kwebd crashes after some time, while it tries to obtain bundled SAN certificate.

       kopano-kwebd.service - Kopano Web Daemon
   Loaded: loaded (/lib/systemd/system/kopano-kwebd.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2020-04-03 15:48:43 CEST; 4s ago
  Process: 28481 ExecStartPre=/usr/sbin/kopano-kwebd setup (code=exited, status=0/SUCCESS)
 Main PID: 28484 (kwebd)
    Tasks: 11 (limit: 4915)
   CGroup: /system.slice/kopano-kwebd.service
           └─28484 /usr/libexec/kopano/kwebd serve --host=meet.mydomain.at --email=hostmaster@mydomain.at --agree --ca=https://acme-v02.api.letsencrypt.org/directory --root=/usr/share/kopano-kweb/www --http-port=

Apr 03 15:48:43 mail3.mydomain.at systemd[1]: Started Kopano Web Daemon.
Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'alias' at end of list
Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'configjson' at end of list
Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'fastcgi2' before 'fastcgi'
Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'folderish' before 'redir'
Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'staticpwa' at end of list
Apr 03 15:48:44 mail3.mydomain.at kopano-kwebd[28484]: Activating privacy features... 2020/04/03 15:48:44 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:45 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:45 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:47 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:47 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:48 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:48 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
root@mail3:/etc/kopano# systemctl status kopano-kwebd
● kopano-kwebd.service - Kopano Web Daemon
   Loaded: loaded (/lib/systemd/system/kopano-kwebd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Fri 2020-04-03 15:48:52 CEST; 9s ago
  Process: 28484 ExecStart=/usr/sbin/kopano-kwebd serve (code=exited, status=1/FAILURE)
  Process: 28481 ExecStartPre=/usr/sbin/kopano-kwebd setup (code=exited, status=0/SUCCESS)
 Main PID: 28484 (code=exited, status=1/FAILURE)

Apr 03 15:48:43 mail3.mydomain.at kopano-kwebd[28484]: [DEV NOTICE] Registered directive 'staticpwa' at end of list
Apr 03 15:48:44 mail3.mydomain.at kopano-kwebd[28484]: Activating privacy features... 2020/04/03 15:48:44 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:45 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:45 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:47 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:47 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:48 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:48 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:49 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:49 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:51 mail3.mydomain.at kopano-kwebd[28484]: 2020/04/03 15:48:51 [INFO] [meet.mydomain.at] acme: Obtaining bundled SAN certificate
Apr 03 15:48:52 mail3.mydomain.at systemd[1]: kopano-kwebd.service: Main process exited, code=exited, status=1/FAILURE
Apr 03 15:48:52 mail3.mydomain.at systemd[1]: kopano-kwebd.service: Unit entered failed state.
Apr 03 15:48:52 mail3.mydomain.at systemd[1]: kopano-kwebd.service: Failed with result 'exit-code'.

      I also have got an Apache-Server running on this machine (for the Webapp). I switched the Apacheserver “off” for testing Meet. But it still does not work.

      Finally I also have got a question concerning: legacy_reverse_proxy

      Will I have to use this option, to run Meet at a server were Kopano & Apache is installed, or is it possible to “push” kwebd to some higher port, so that it does not interfere with Apache?

      1 Reply Last reply Reply Quote 0
      • longsleep
        longsleep Kopano last edited by

        @mcdaniels said in kopano-kwebd running but failing while obtaining bundled SAN cert:

        Obtaining bundled SAN certificate

        Do you use automatic certificates (ACME via Let’s Encrypt for examplle?). If so,

        Let’s encrypt just offers

        • HTTP-01, which works on port 80
        • TLS-SNI-01, which works on port 443
        • DNS-01, which does not require any open ports but rather works via a special TXT record you need to create for your domain.

        Kweb built in configuration only can do HTTP-01 and TLS-SNI-01 as of now.

        I suggest to use the same certificate/key which Apache is using.

        1 Reply Last reply Reply Quote 0
        • mcdaniels
          mcdaniels last edited by

          @longsleep said in kopano-kwebd running but failing while obtaining bundled SAN cert:

          Do you use automatic certificates (ACME via Let’s Encrypt for examplle?).

          Yes I do use ACME for my domain which is mail3.mydomain.com. Thought of using meet1.mydomain.com for kopano meet, but this does not seem to work. If I read your lines, it is clear to me that it cannot work. On the other handside, I completely shutdown apache and used the standardports for kweb. This also does not work.

          The thing is (as far as I understood right): I have to set up a separate virtualhost + DNS entry for kopano-meet. Lets say meet1.mydomain.com.
          If so, I will need a separate ssl-certificate for meet (or use a wildcard-cert for *.mydomain.com. I cannot use the ssl-cert (certbot) which I use for mail3.mydomain.com.

          So hm do you mean I should completly switch to apache (Kopano Webapp & Meet)?

          longsleep 1 Reply Last reply Reply Quote 0
          • longsleep
            longsleep Kopano @mcdaniels last edited by

            @mcdaniels said in kopano-kwebd running but failing while obtaining bundled SAN cert:

            @longsleep said in kopano-kwebd running but failing while obtaining bundled SAN cert:

            Do you use automatic certificates (ACME via Let’s Encrypt for examplle?).

            Yes I do use ACME for my domain which is mail3.mydomain.com. Thought of using meet1.mydomain.com for kopano meet, but this does not seem to work. If I read your lines, it is clear to me that it cannot work. On the other handside, I completely shutdown apache and used the standardports for kweb. This also does not work.

            Well it should work when kweb can use port 80. Otherwise something with your Let’s Encrypt account is wrong. Maybe try another email.

            1 Reply Last reply Reply Quote 0
            • mcdaniels
              mcdaniels last edited by mcdaniels

              Thanks for your answer. It may be that I have not fully understood how Meet works. But shouldn’t it give me a webinterface if I call http://meet1.mydomain.com ?

              I tried it via port 80 before and it gave me a 404 - not found. (this message came from kweb)

              Edit: Oh man… sorry… perhaps I should have tried: http(s)://meet1.mydomain.com/meet

              SORRY!

              1 Reply Last reply Reply Quote 0
              • First post
                Last post