> Source: https://meetrix.io/blogs/openfire-lets-encrypt-ssl/ > Markdown copy of that page. Cite the URL above, not this file. IAM & Security # Openfire SSL Certificate Setup with Let's Encrypt (2019 Guide) [By Buddhika Jayawardhana](https://meetrix.io/blogs/authors/buddhika-jayawardhana/) • October 31, 2019 • 3 min read Written in 2019 This guide was written for Openfire 4.4 on Ubuntu 18.04 and is kept as it was published, with small corrections. The admin console in current Openfire releases is laid out a little differently, and the certbot install command has changed, but the idea is the same: get a certificate from Let's Encrypt, then import the private key and certificate into Openfire's identity store. For a fresh install on a current Ubuntu release, start with [installing Openfire on Ubuntu](https://meetrix.io/blogs/install-openfire-ubuntu/). Out of the box, [Openfire](https://www.igniterealtime.org/projects/openfire/) generates a self-signed certificate. XMPP clients either warn about it or refuse to connect, and other servers won't federate with it. Replacing it with a free Let's Encrypt certificate fixes both. ## Step 1: Generate the certificate with certbot Point your XMPP domain at the server, open **TCP port 80** for the [Let's Encrypt HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/), and request a certificate in standalone mode: ```bash sudo certbot certonly --standalone -d yourdomain.com ``` The files land in `/etc/letsencrypt/live/yourdomain.com/`. You need two of them for the import: `privkey.pem` and `cert.pem`. ## Step 2: Open the Openfire SSL identity store In the Openfire admin console, open the certificate store management page: ```plaintext http://yourdomain.com:9090/security-certificate-store-management.jsp ``` ![Openfire admin console certificate store management page listing the identity store and trust stores](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-certificate-console.jpg) Click **Manage Store Contents** under the **Identity Store**. ![Openfire identity store contents page with the existing self-signed certificate and the import link](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-ssl-identity-store.jpg) Click the link to import a new certificate. ## Step 3: Paste the key and certificate On the server, print the two files: ```bash sudo cat /etc/letsencrypt/live/yourdomain.com/privkey.pem sudo cat /etc/letsencrypt/live/yourdomain.com/cert.pem ``` Paste the contents of `privkey.pem` into **Content of Private Key file** and the contents of `cert.pem` into **Content of Certificate file**, then save. ![Openfire import certificate form with fields for the private key content and the certificate content](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-ssl-import.jpg) Once the import succeeds, the Let's Encrypt certificate appears in the identity store. Remove the old self-signed certificate for the same domain so Openfire doesn't keep serving it. ![Openfire identity store after the import, showing the new Let's Encrypt certificate alongside the self-signed one to delete](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-import-done.jpg) ## Step 4: Add the chain to the server trust store For server-to-server connections, open the trust store used for connections from other servers: ```plaintext http://yourdomain.com:9090/security-truststore.jsp?connectionType=SOCKET_S2S ``` Click **Manage Store Contents**, then the import form. Set the alias to `Let's Encrypt`, paste one certificate from `fullchain.pem` into **Content of Certificate file**, and save. ![Openfire trust store import form with the alias set to Let's Encrypt and a certificate pasted in](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-trust-store.jpg) Restart Openfire so it picks up the new identity certificate: ```bash sudo systemctl restart openfire ``` ![Openfire certificate list showing the Let's Encrypt certificate installed and valid](https://meetrix.io/blog-images/paas-products-articles/openfire-lets-encrypt-ssl/openfire-ssl-finish.jpg) ## About renewals The one thing this 2019 method doesn't solve: Let's Encrypt certificates last 90 days. certbot renews the files in `/etc/letsencrypt` automatically, but Openfire keeps its own copy in its keystore, so the import has to happen again after each renewal. Put a reminder in your calendar at the very least, or script it with a [certbot deploy hook](https://eff-certbot.readthedocs.io/en/stable/using.html). The same deploy-hook pattern is shown for another service in [installing Coturn on Ubuntu](https://meetrix.io/blogs/install-coturn-ubuntu/). For background on the protocol Openfire serves, see [what XMPP is and how it works](https://meetrix.io/blogs/what-is-xmpp/). ## Frequently Asked Questions Why does Openfire still show a self-signed certificate after importing Let's Encrypt? Either the old self-signed entry is still in the identity store and being chosen first, or Openfire was not restarted after the import. Remove the self-signed certificate for your domain from the identity store, then restart Openfire. Do I have to import the certificate again every 90 days? With the manual method in this guide, yes. Let's Encrypt certificates expire after 90 days and certbot renews the files on disk, but Openfire keeps its own copy in its keystore. Script the import, or terminate TLS in front of Openfire, so renewals don't depend on someone remembering. Should I use cert.pem or fullchain.pem? This 2019 guide pasted cert.pem into the certificate field, which worked with the clients we tested then. If clients report an incomplete certificate chain, use fullchain.pem instead so the intermediate certificate is served too. Which port must be open for certbot? TCP 80, because certbot's standalone mode answers the HTTP-01 challenge itself. Nothing else can be listening on port 80 during the request, and the port can be closed again afterwards if you prefer. Where does Openfire store its SSL certificate? In its own keystore, not on disk beside the certbot files. Openfire's identity store holds the private key and certificate you paste into the admin console, and the trust store holds certificates from the other servers it federates with. Meetrix Store Jitsi Meet Self-hosted video calls for 50 to 500 users [Deploy it](https://meetrix.io/store/jitsi-meet/) Meetrix Store New Deploy what this guide covers, pre-configured. - [Jitsi Meet Self-hosted video calls for 50 to 500 users](https://meetrix.io/store/jitsi-meet/) - [Coturn TURN/STUN for WebRTC, no per-minute relay fees](https://meetrix.io/store/coturn/) - [Mattermost Team chat, a self-hosted Slack alternative](https://meetrix.io/store/mattermost/) - [RustDesk Remote desktop AMI, a TeamViewer alternative](https://meetrix.io/store/rustdesk/) - [Supabase Postgres, Auth, Storage and Realtime, self-hosted](https://meetrix.io/store/supabase/) - [OpenVPN Encrypted remote access, no per-user fees](https://meetrix.io/store/openvpn/) [Browse all products](https://meetrix.io/store/)