Let's Encrypt with Scala Stream Collector

For engineers Collectors
1

I’m trying to set up the Scala Stream Collector with Kinesis, but would like to use Let’s Encrypt to create the certificates.

I’m not sure how to access these in hocon files. My initial approach was to access the certificate directly but with the following docker compose / hocon config I keep getting the error ‘Key store file … does not exist’:

My docker-compose.yaml:

version: '3.3'
services:
  snowplow:
    image: snowplow/scala-stream-collector-kinesis:1.0.0
    command: ["--config", "/snowplow/config/config.hocon"]
    environment:
      - AWS_CBOR_DISABLE=1
    ports:
      - "80:8080"
      - "443:9543"                       
    volumes:   
      - ./data/snowplow/config:/snowplow/config
      - ./data/certbot/conf:/etc/letsencrypt

The ssl section in my hocon file:

ssl-config {
  debug = {
      ssl = true
  }
  keyManager = {
    stores = [{
      type =  "PKCS12",                                                                                       
      classpath = false,  
      path = "/etc/letsencrypt/conf/live/[domain]/fullchain.pem",
      password = 'password' 
    }]
  } 
  loose {
    disableHostnameVerification = false
  }
}

I’m also not sure how I can get the pem certificate to be used (if at all) or if I should proxy this via nginx as suggested in Using SSL with Scala Collector on Docker but I’m not sure how to write the nginx configuration for this server in this case.

I’m assuming I’ll need to create a location similar to below, but not sure about the details:

server {
        listen 443 ssl;
        server_name [domain];
        location /i {
                root [not sure what to place here];
        }
1 Like
2

Hi @hanskohls - the SSL configuration support in the collector does not yet support passing a PEM key directly. You will need to convert the PEM and Certificate into a PKCS12 format to get this to work - this can be done pretty easily with OpenSSL:

openssl pkcs12 \
  -export \
  -out collector.p12 \
  -inkey collector_key.pem \
  -in collector_cert.pem \
  -passout pass:

My SSL config:

  ssl-config {
    debug = {
      ssl = true
    }

    keyManager = {
      stores = [
        {type = "PKCS12", classpath = false, path = "collector.p12", password = "" }
      ]
    }

    loose {
      disableHostnameVerification = false
    }
  }

Hope this helps!