I host passbolt on an Ubuntu 20.xx server using the source/script install.
Cannot get the QR code to scan returns an error each time. I got as far as guessing its a certificate error. (I presume).
Certbot/letsencrypt produces 4 keys, and I did try importing them to my android phone but that always returns a "a security key is required to install this certificate)
CERTIFICATES
============
I use certbot with Apache to generate self-signed certs.
it generates 4, cert, chain, fullchain and privkey, the latter two of which are refered to in the apache config
OTHER
======
Server is behind cloudflare. I have tried with both cloudflare proxy on and off
JWT Check
=========
dim@ubuntu:/var/www/passbolt/config/jwt$ openssl rsa -in /var/www/passbolt/config/jwt/jwt.key -check -noout
RSA key ok
dim@ubuntu:/var/www/passbolt/config/jwt$ if openssl rsa -in /var/www/passbolt/config/jwt/jwt.key -outform PEM -pubout 2>/dev/null | diff /var/www/passbolt/config/jwt/jwt.pem - > /dev/null; then echo "OK: JWT key matches with JWT pem"; else echo "NOT OK: JWT key and pem doesn't match"; fi
OK: JWT key matches with JWT pem
Apache Config (Included the suggest rewrite)
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName REMOVED
DocumentRoot /var/www/passbolt/webroot/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html
ErrorDocument 502 /502.html
ErrorDocument 503 /503.html
ErrorDocument 504 /504.html
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www/passbolt/>
Options FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
<Location "/auth/verify.json">
SecRuleRemoveById 200004 942100
</Location>
<Location "/import/resources.json">
SecRuleRemoveById 942100
</Location>
<Location "/resources.json">
SecRuleRemoveById 942100
</Location>
<LocationMatch "^/resources/.*">
SecRuleRemoveById 911100 980130 942100
</LocationMatch>
<LocationMatch "^/users/.*">
SecRuleRemoveById 911100
</LocationMatch>
<LocationMatch "^/setup/completeRecovery/.*\.json">
SecRuleRemoveById 980130 911100 949110
</LocationMatch>
SSLCertificateFile /etc/letsencrypt/live/pass.dimspace.xyz/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/pass.dimspace.xyz/privkey.pem
</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:80>
ServerName REMOVED
DocumentRoot /var/www/passbolt/webroot/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www/passbolt/>
Options FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteCond %{SERVER_NAME} =pass.dimspace.xyz
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
SecRuleEngine DetectionOnly
</VirtualHost>
</IfModule>
Apache Test
dim@ubuntu:/etc/apache2/sites-available$ sudo apachectl configtest
Syntax OK
SSL Test
Checklist
[x ] I have read intro post: About the Installation Issues category
[x ] I have read the tutorials, help and searched for similar issues
[x ] I provide relevant information about my server (component names and versions, etc.)
[x ] I provide a copy of my logs and healthcheck
[x ] I describe the steps I have taken to trouble shoot the problem
[ x] I describe the steps on how to reproduce the issue
