This is Part 3 in the Playing Custom Media Streams with the Amazon Echo series of posts
This post has not yet been completed
Part 2: Configure a Raspberry PI
Part 3: Obtains and Install LetsEncrypt Certificates
Part 4: Design and Build a https relay
Part 5: Opening network ports to allow correct operation
Part 6: Developing a simple media player application
Part 7: Installing a modified UPNP media server
Part 8: Installing a pseudo-radio station and bridging the UPNP server to the https relay
Part 9: Adding Chromecast casting push support
LetsEncrypt is a freely available certificate authority, which is accepted / trusted by many client applications, including the Amazon Echo.
It integrates into a web browser, and this feature is required in order to keep the certificates up to date.
Add and entry into your DNS
Choose a domain name, and set a DNS record to point to your modem's public IP address - e.g. secure.domain.com.
Or use a dyndns, noip or similar service to associate your modem IP address with a domain name.
Setting up your firewall
Ensure that your firewall forwards the internet-side port 433 to port 433 on your pi device.
Ensuring port 433 is available for letsencrypt
Ensure nginx is not running for the moment.
localadmin$ sudo service nginx stop
Configuring letsencrypt
Log into your pi as the administrator, and download the letsencrypt software:
Now, create the certificates with letsencrypt
If you are planning to run a https server: configure nginx
Install nginx
Ensure that the file includes the following:
Then in the /etc/nginx/sites-enabled directory, remove the 'default' file, and create a link to the sites-enabled file you've created.
Finally, start the nginx webserver.
Log into your pi as the administrator, and download the letsencrypt software:
localadmin$ sudo apt-get update
localadmin$ sudo apt-get install -y git
localadmin$ sudo git clone https://github.com/certbot/certbot /opt/letsencrypt
Now, create the certificates with letsencrypt
localadmin$ sudo /opt/letsencrypt/letsencrypt-auto certonly --standalone -d secure.domain.com [ -d another.domain ... ]This will ask some simple questions (email, terms and conditions) and then will create an account reference in /etc/letsencrypt/accounts, and will create the certificate files in /etc/letsencrypt/live
Install nginx
localadmin$ sudo apt-get install nginxCreate a folder on your pi in /data/secure.domain.com with the following structure:
/data/secure.domain.com/In the sites-enabled folder, create a file for your domain - e.g. secure.domain.com, using the default example from /etc/nginx/sites-enabled/default.
bin/
nginx/
sites-enabled/
logs/
www/
Ensure that the file includes the following:
server {
listen 443 ssl default_server ;
listen [::]:443 ssl default_server ;
listen 80 default_server ;
listen [::]:80 default_server ;
server_name secure.domain.com ;
root /data/$server_name/www ;
....
error_log /data/secure.domain.com/logs/error.log error ;
access_log /data/secure.domain.com/logs/access.log ;
ssl_certificate /etc/letsencrypt/live/secure.domain.com/fullchain.pem ;
ssl_certificate_key /etc/letsencrypt/live/secure.domain.com/privkey.pem ;
....
Then in the /etc/nginx/sites-enabled directory, remove the 'default' file, and create a link to the sites-enabled file you've created.
localadmin$ cd /etc/nginx/sites-enabled
localadmin$ sudo rm default
localadmin$ ln -s /data/secure.domain.com/nginx/sites-enabled/secure.domain.com .
Finally, start the nginx webserver.
localadmin$ sudo service nginx start