Telegram Bot - 带有letsencrypt证书的Webhook SSL错误

Question

我已经尝试修复此错误两天了，但仍然没有找到任何可行的方法...所以这是我的问题：

我之前在 Raspberry Pi 上使用 Certbot (letsencrypt) 设置了 Telegram Bot，它运行良好。现在我想在我的新 HomeServer（一个 Manjaro Linux 机器）上构建同样的东西。

所以我安装了 Apache 和 Certbot，它与任何浏览器完美配合，可以使用 https://<mydomain> 访问我的网站。但是...当我使用证书设置 Telegram 机器人的 Webhook 时，您必须像这样通过：

curl -F "url=https://<mydomain>/botTelegram/index.php" -F "certificate=@/etc/letsencrypt/live/<mydomain>/fullchain.pem" https://api.telegram.org/bot723985628:AAHiEXNJgXZ-mGprEhGNc1QxiVpGfhxK_9A/setWebhook

它总是给我同样的错误：

{
    "ok": true,
    "result": {
        "url": "<myDomain>",
        "has_custom_certificate": true,
        "pending_update_count": 1,
        "last_error_date": 1588255882,
        "last_error_message": "SSL error {error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed}",
        "max_connections": 40
    }
}

然后我搜索了解决方案，每个人都在说，你应该尝试使用https://www.ssllabs.com/ssltest/analyze.html?d=<mydomain>&hideResults=on 测试你的网站，然后检查在 Chain 问题下是否写了“无”以外的其他内容，在这种情况下，你必须给服务器“完整的证书链”。所以我确实运行了这个测试，但是写的是“None”，因为我已经给了 Apache fullchain.pem 证书。

Chain Issues Screenshot

由于 Certbot 创建了多个证书：我还尝试将 chain.pem 和 cert.pem 传递给 /setWebhook 请求，但出现相同的错误。

这是我创建它们的方式：

certbot certonly --webroot /srv/http -d <myfirstdomain> -d <myseconddomain>

所以现在我真的不知道如何解决这个问题，因为 SSL 适用于浏览器，但不适用于 Telegram Webhook...

如果这里是我的/etc/httpd/conf/extra/httpd-ssl.conf 的一部分：

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
#   in mind that if you have both an RSA and a DSA certificate you
#   can configure both in parallel (to also allow the use of DSA
#   ciphers, etc.)
#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
#   require an ECC certificate which can also be configured in
#   parallel.
SSLCertificateFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"
#SSLCertificateFile "/etc/httpd/conf/server-dsa.crt"
#SSLCertificateFile "/etc/httpd/conf/server-ecc.crt"

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
#   ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile "/etc/letsencrypt/live/<mydomain>/privkey.pem"
#SSLCertificateKeyFile "/etc/httpd/conf/server.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-dsa.key"
#SSLCertificateKeyFile "/etc/httpd/conf/server-ecc.key"

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convenience.
#SSLCertificateChainFile "/etc/letsencrypt/live/<mydomain>/fullchain.pem"

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   Note: Inside SSLCACertificatePath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
#SSLCACertificatePath "/etc/httpd/conf/ssl.crt"
#SSLCACertificateFile "/etc/httpd/conf/ssl.crt/ca-bundle.crt"

那么，我希望有人能够帮助我解决这个问题，因为我真的不知道这里出了什么问题......

编辑：

我现在删除了证书，并使用 Certbot 重新创建了它们，但使用了像 certbot --apache -d <myfirstdomain> -d <myseconddomain> 这样的 --apache 选项，但它仍然不起作用，我仍然遇到同样的错误......

这是由 Certbot 在/etc/letsencrypt/options-ssl-apache.conf 创建并链接到 Apache 配置中的新配置：

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384>SSLHonorCipherOrder     on

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common```

Answer 1

要解决此问题，我只需在不通过证书的情况下发出 .../setWebhook 请求并将 https:// 放在 URL 前面。

因为我认为 Certbots 证书是“自签名”的，但显然不是，我在想什么？我无法相信这是一件如此简单的事情，以至于我忽略了......

那么，我仍然希望这可以帮助任何可能遇到同样愚蠢问题的人。 :)