Webhook: SSL Setup

[jhaltd]

I'm trying to setup Webhook to listen for updates from Shopify. The program is getting the notifications, but I'm getting the following error:

http: TLS handshake error from 34.73.136.177:57358: remote error: tls: unknown certificate authority

I'm assuming that I need to add Shopify's signature, but I'm unsure how to go about doing that. Can someone please point me in the right direction? Thanks,

Dunc

[daze18]

I 2nd this - is there any additional info on setting up an https / ssl listener? I can't get it to work to save my life.

[jhaltd]

Bueller, Bueller... Hello? Can anyone throw me a bone? Point me in the right direction to get this working with https, please!

[MaxxWyndham]

I received similar errors as you when interacting with Github webhooks.
Turns out I needed to use the fullchain.pem for -cert and the privkey.pem for -key. Assuming you're using letsencrypt generated certs.

[adnanh]

There is a section for using SSL in the Readme.

Also read what @MaxxWyndham said :-)

[jamietanna]

Would it be possible to see if we can use certmagic to automate the cert provisioning, as Caddy does?

[adnanh]

@jamietanna Appreciate your feedback, however I'd keep cert provisioning outside the webhook. I would much rather have a page in the docs/ folder explaining how to get SSL set up using other tools for automating process of obtaining certificates (such as certbot), since, in my opinion, having baked-in support for cert provisioning currently falls out of scope of this project.

[moorereason]

Bueller, did we answer your question? :smiley:

[victorromeo]

So, I've recently setup a https instance, and can lend some perspective not in the ssl notes on the main page.
You'll need to use -cert <cert.pem> -key <key.pem> -secure to get the server to correctly secure the connection. The -secure flag doesn't appear on the main README.

All the available parameters are here

To create a cert.pem, you need to concatenate your certificates into one file, using any text file editor. No empty lines in the file, anywhere.

-----BEGIN CERTIFICATE-----
Your Server Certificate Hash here ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Signing Certificate Authority here ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Global Certificate Authority here ...
-----END CERTIFICATE-----

Then, put your Key hash into another text file by itself.

-----BEGIN PRIVATE KEY-----
Your private key here....
-----END PRIVATE KEY-----

Also check permissions on the file, as it requires read permissions it also depends on how you start the webhook process.

• ie. chmod 400 cert.pem (minimum)
• ie. chmod 400 key.pem (minimum)
• Don't allow global read rights to these files '444' is bad