Question SSL certificate location for Prosody import

[CavemanJoe]

Server operating system version

Ubuntu 20.04.6 LTS

Plesk version and microupdate number

Version 18.0.55 Update #1

Hey all, I'm trying to set up a Prosody XMPP server on my dedicated box running Plesk on Ubuntu 20.04, two weeks old.

I come from fifteen-odd years of either Webmin or manual configuration file fiddling, so I felt quite spoiled when I could just press a button and have Let's Encrypt sort my SSL certs out for me! My problem is that Prosody needs to know where my .cert and .key files are, and as far as I can tell from my auto-generated httpd.conf files, Plesk stores them both under heavily obfuscated names inside /opt/psa/var/certificates. Names like scfLlsL3A, for example, instead of example.com.key or example.com.cert.

This wouldn't be a massive problem, I could just tell Prosody hey go get those obfuscated files and use those, except that there are DIRE WARNINGS at the top of my Plesk-generated httpd.conf file saying DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY, which makes me wonder whether the next time Plesk updates my certificates, those obfuscated filenames will change and my Prosody server will break.

So, question, has anybody here set up Prosody on a machine running Plesk before? If so, how did you wrangle the certs? If not, am I good to just point Prosody at the two obfuscated files, or will they change, or are they maybe mirrored in a more convenient location somewhere else on the system? Or is there a configuration setting somewhere to tell Plesk to quit randomizing the SSL cert filenames?

Thanks!

 

[Peter Debik]

I am afraid that running that stand-alone server along Plesk and letting it use configuration files that are controlled by Plesk will not work properly. If you find a Docker image for it, maybe you can run it inside Docker. But regarding SSL, Plesk does randomize the filenames, and the extensions will replace cert files with new randomized names occasionally upon renewals or other changes to the certificate.

 

[CavemanJoe]

Hey Peter, appreciate the reply. Is there a configuration option to prevent Plesk from randomizing these filenames?

 

[Kaspar]

Hey Peter, appreciate the reply. Is there a configuration option to prevent Plesk from randomizing these filenames?

There isn't. You best option to run Prosody on a Plesk server is trough Docker. Due to conflicting configuration needs for both Plesk and Prosody they don't go well together.

 

[CavemanJoe]

Found the originals, they're under
/usr/local/psa/var/modules/letsencrypt/etc/live/
and can be imported with a periodic call to
prosodyctl --root cert import /usr/local/psa/var/modules/letsencrypt/etc/live/

Is there a Plesk-Approved way to add the --deploy-hook argument to certbot, or am I stuck with cronning that a couple minutes after the renewal?

 

[Peter Debik]

From Plesk Event Manager:


Not sure whether any of these are fired on an automatic renewal of a certificate. You'd need to test it.

 

[brentpeter]

ooh okay.. i think this thread answers my question

 

[Kaspar]

ooh okay.. i think this thread answers my question

What question is that?