How to fix HTTPS connection if the certificate is broken

One may accidentally break HTTPS connection as a result of incorrect server configuration. If users rely mostly on client applications, broken HTTPS connection will have practically no effect on your infrastructure, but it will create certain inconveniences:

• The server control panel, personal area, and conference scheduler will not be accessible in all client applications.
• Conference participation via WebRTC (from browsers) will not be available.
• The scripts that involve TrueConf Server API will no longer run.

Why HTTPS connection may be broken

The most probable causes:

1. When TrueConf Server was migrated from one machine to another, HTTPS connection could be broken, if the administrator forgot to move some of the required files. In this case, authorization in the control panel will be unavailable.
2. When the external name of the server was changed, one could forget to sign a certificate. In this case, the guest page will be unavailable and the browser will display the following error: NET::ERR_CERT_AUTHORITY_INVALID.
3. Your organization uses the certificates signed by a local certification authority. If certificate configuration is not correct, HTTPS connection may not work and the browser will display this error: ERR_SSL_KEY_USAGE_INCOMPATIBLE.

General solution

Regardless of the specific cause, there is a general solution to this approach. To fix this issue, you need to move the correct certificate and its private key to the target machine or sign a new certificate if it is possible. The articles below show how to get a free TLS certificate.

• How to create a “Let’s Encrypt” certificate on Windows
• How to create a “Let’s Encrypt” certificate on Linux

If your server is installed on the OS that supports GUI, take these steps:

1. Get direct access to the OS or access it with the help of RDP, xRDP or VNC (of course, this type of access has to be configured in advance).
2. Go to the localhost address from the default browser.
3. On the guest page, click the Administrator login button.
4. In HTTPS settings, upload the correct certificate and its private key.

No access from localhost / OS without GUI

In most cases, the security department of any organization insists that password-free access to the control panel from localhost should be closed. In this case and if you installed the server on the OS without GUI, follow the instruction below.:

To solve this problem, we will move the files to the target machine with the help of SSH. However, at first, you will need to name these files in the correct way:

• Certificate — custom.crt
• Key — custom.key

How to move certificates from Windows to Windows

1. Run PowerShell as the administrator.
2. Go to the folder with the certificate and key:
   
   PowerShell

   cd /targer-dir/

   1	cd /targer-dir/

3. Due to the peculiarities of how paths are interpreted on Windows, we will use SFTP instead of SCP to move files. Connect to the target machine:
   
   PowerShell

   sftp admin@10.110.2.242

   1	sftp admin@10.110.2.242

4. Go to the folder with HTTPS settings:
   
   PowerShell

   cd 'C:/Program Files/TrueConf Server/httpconf/ssl/'

   1	cd 'C:/Program Files/TrueConf Server/httpconf/ssl/'

5. Move the two files with the command:
   
   PowerShell

   put custom.crt put custom.key

   1 2	put custom.crt put custom.key

How to move the certificates from Linux to Linux

1. Open the terminal.
2. Go to the folder with the certificate and key:
   
   cd /targer-dir/

   1	cd /targer-dir/

3. Use SCP to move the certificate and key to the target machine, in the folder with HTTPS settings:
   
   scp custom.crt custom.key admin@10.110.2.242:/opt/trueconf/server/etc/webmanager/ssl/

   1	scp custom.crt custom.key admin@10.110.2.242:/opt/trueconf/server/etc/webmanager/ssl/

4. Next, connect to the target machine via SSH and run the commands below to set the read rights for the moved files and set trueconf as the owner:
   
   sudo chmod 400 /opt/trueconf/server/etc/webmanager/ssl/custom.crt /opt/trueconf/server/etc/webmanager/ssl/custom.key sudo chown trueconf /opt/trueconf/server/etc/webmanager/ssl/custom.crt /opt/trueconf/server/etc/webmanager/ssl/custom.key

   1 2	sudo chmod 400 /opt/trueconf/server/etc/webmanager/ssl/custom.crt /opt/trueconf/server/etc/webmanager/ssl/custom.key sudo chown trueconf /opt/trueconf/server/etc/webmanager/ssl/custom.crt /opt/trueconf/server/etc/webmanager/ssl/custom.key

Backup solution

If you do not have a new certificate, you will need to disable the use of HTTPS.

Windows

1. Delete files:
   
   C:\Program Files\TrueConf Server\httpconf\opt\listen.conf C:\Program Files\TrueConf Server\httpconf\opt\config.ssl

   1 2	C:\Program Files\TrueConf Server\httpconf\opt\listen.conf C:\Program Files\TrueConf Server\httpconf\opt\config.ssl

2. Restart the TrueConf Web Manager service.

Linux

1. Delete files:
   
   /opt/trueconf/server/etc/webmanager/opt/listen.conf /opt/trueconf/server/etc/webmanager/opt/config.ssl

   1 2	/opt/trueconf/server/etc/webmanager/opt/listen.conf /opt/trueconf/server/etc/webmanager/opt/config.ssl

2. Restart the trueconf-web service.