# Problems with installing SSL on kolibri-server **URL:** \ **Category:** Kolibri\ **Created:** [February 29, 2024, 12:01pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988 "2024-02-29T12:01:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Antonio\_Herrera](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/antonio_herrera/32/1572_2.png) [@Antonio\_Herrera](https://community.learningequality.org/u/Antonio_Herrera)\ **Post date:** [February 29, 2024, 12:01pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/1 "2024-02-29T12:01:59Z")
We need support with installing SSL on a kolibri-server. We have installed kolibri-server on Ubuntu Ubuntu 22.04 URL: [http://class.ytfacademy.org](http://class.ytfacademy.org) This is what we’ve done so far: INSTALL KOLIBRI-SERVER sudo add-apt-repository ppa:learningequality/kolibri sudo apt-get update sudo apt-get install kolibri-server selected ports 80 and 81 Verified that Kolibri works without SSL on [http://class.ytfacademy.org](http://class.ytfacademy.org) Verified that it loads SCORM ZIPPED content that we have imported from a channel that we own at Studio Copied the SSL certificate bundle and key files on /etc/ssl Copied the file “class.ytfacademy.org.conf” on /etc/nginx/sites-enabled Restarted nginx with sudo service nginx restart Checked that the site loads the SSL certificate and it allows to access the Kolibri facility at: [http://class.ytfacademy.org](http://class.ytfacademy.org) Tested to load SCORM content with a negative result this is the URL that we get by inspecting the SCORM element not charging: [https://class.ytfacademy.org:81/content/static/hashi/hashi-cea3be36e609aeba234a13b27afd33b8.html](https://class.ytfacademy.org:81/content/static/hashi/hashi-cea3be36e609aeba234a13b27afd33b8.html) This is the content of the class.ytfacademy.org.conf file that we placed at /etc/nginx/sites-enabled/: * * * ```auto server { listen 80; server_name class.ytfacademy.org; } map $server_port $upstream_port { 443 80; 8443 81; } server { listen 443 ssl; listen 8443 ssl; ssl_certificate /etc/ssl/class-ytfacademy-ssl-bundle.crt; # REPLACE HERE ssl_certificate_key /etc/ssl/class-ytfacademy-private.key; # REPLACE HERE location / { proxy_pass http://167.71.83.17:80; } } ``` * * * Have we done something wrong, or are we missing something? ---
**Author:** ![jredrejo](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/jredrejo/32/561_2.png) [@jredrejo](https://community.learningequality.org/u/jredrejo)\ **Post date:** [February 29, 2024, 4:34pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/2 "2024-02-29T16:34:14Z")
hello @Antonio_Herrera yes, you’re missing several things. One of the reasons of `kolibri-server` to exist is to help users with a tested configuration. If you’re going to do your own configuration, installing kolibri-server does not make sense, just install `kolibri` and do your own setup, because now you’re mixing two different configuration files. If you want to reuse kolibri-server setup, you can take a look at your kolibri folder where you will see a `nginx.conf` with all the needed parts (kolibri uses a second port for security reasons when running html5 apps in a sandbox, and the uwsgi configuration) . That file will be overwritten everytime you start kolibri-server. To add your custom setup you can do it at` /etc/kolibri/nginx.d/` . There you can also replace the use of the mentioned nginx.conf by your own setup if you prefer it. Anyway, for a very customized installation, as the one @blaine has suggested, the recommendation is doing your own setup using only the `kolibri` package, not using `kolibri-server` because your changes and its configs will conflict whenever it starts. Hope this helps José ---
**Author:** ![Antonio\_Herrera](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/antonio_herrera/32/1572_2.png) [@Antonio\_Herrera](https://community.learningequality.org/u/Antonio_Herrera)\ **Post date:** [February 29, 2024, 5:19pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/3 "2024-02-29T17:19:44Z")
Hi José Luis, we really appreciate your quick reply and willingness to help. Our intention is to follow the recommendations from Learning Equality and take advantage of the pre-set conditions of kolibri-server. The configurations we’ve done until now were not intended to apply our criteria. It has been the result of our “best guess” about how to configure SSL for our domain [class.ytfacademy.org](http://class.ytfacademy.org) By reading your message and checking on the folder and file structure, we come to the conclusion that the way to install SSL so that it works with html5 packages is to place a .conf file a this folder: /etc/kolibri/nginx.d/ If that’s correct, is there a .conf file template that we can use and only change our domain, IP address and location of the SSL certificate files? . ---
**Author:** ![jredrejo](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/jredrejo/32/561_2.png) [@jredrejo](https://community.learningequality.org/u/jredrejo)\ **Post date:** [February 29, 2024, 5:34pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/4 "2024-02-29T17:34:57Z")
> Our intention is to follow the recommendations from Learning Equality and take advantage of the pre-set conditions of kolibri-server. oh, sure, you can take those configs as a template and adapt it to your needs, or improve them (please, let us know if you do that, to apply any improvement for all the users) > If that’s correct, is there a .conf file template that we can use and only change our domain, IP address and location of the SSL certificate files? The best template would be the one in the nginx.conf file present in the directory where kolibri database is located ([Troubleshooting — Kolibri User Guide](https://kolibri.readthedocs.io/en/latest/manage/get_support.html#home) ) , that file together will the ones you see in `/etc/kolibri/nginx.d/` do it all. But, please, be aware that kolibri-server starting scripts rewrites that nginx.conf file when it starts, so you’ll have to disable it if you add your own config. However, these files don’t have a ssl configuration, for that part, the suggestions @blaine gave before in this thread are the way to go. ---
**Author:** ![blaine](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/blaine/32/479_2.png) [@blaine](https://community.learningequality.org/u/blaine)\ **Post date:** [March 1, 2024, 4:57pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/5 "2024-03-01T16:57:02Z")
> [@Antonio\_Herrera](#): > > `map $server_port $upstream_port` If it’s helpful to clarify, the approach I previously suggested with the above `map` expression between ports works well for a reverse HTTP proxy where you could avoid duplicating the same `location` block. The `kolibri-server` package uses separate `location` blocks because it uses a uwsgi proxy. So you may copy that nginx.conf, add your SSL configuration to those blocks, and adjust ports as necessary. The `kolibri-server` package should automatically configure `ZIP_CONTENT_ORIGIN` in Kolibri’s `options.ini`. So if you change the port that nginx listens on for HTML5 / “hashi” serving, please be aware you may need to change that in the `options.ini`. ---
**Author:** ![Antonio\_Herrera](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.learningequality.org/antonio_herrera/32/1572_2.png) [@Antonio\_Herrera](https://community.learningequality.org/u/Antonio_Herrera)\ **Post date:** [March 1, 2024, 6:10pm UTC](https://community.learningequality.org/t/problems-with-installing-ssl-on-kolibri-server/2988/6 "2024-03-01T18:10:42Z")
Thanks again for your continued help ! Actually we choose kolibri-server ports 80 and 81 during installation because those are the ports where nginx is listening. Therefore, maybe we would not need the ports mapping? Another approach could be, is there any way to get a paid service either directly from Learning Equality or a pool of experts who could do the installation for us? We would provide the certificate files in such scenario.