Trouble configuring SSL for Calibre server on Windows

hollowpoint · 05-31-2021, 05:39 AM

I'm running Calibre 5.19 content server on Win10 x64. Goal is to configure it for internet access with devices.

Here's what is working:
1. Configured port forwarding on home network.
2. Created a friendly host name using no-ip.com.
3. Configured a clear text user name and password, log in, and access books. Tested this to confirm it works, but then disabled, as I don't want to leave a port open to my home PC with unencrypted credentials going over the wire.

Issue is I haven't been able to create a free SSL cert to use with a non-registered IP address, and configure it in the SSL fields on the Calibre web server Advanced tab. Tried a few different approaches using ZeroSSL with my no-ip friendly domain name, but nothing worked. I'm following the directions here in the Calibre docs, but having issues with the SSL details.

Questions:
1. Can you create a free SSL cert to use with just an IP address (it's not actually a registered domain name--I just want to access my books, not create a website)?

2. What's the simplest tool and process to use to generate the certificate and key file to use on Windows? I see a lot of different sites, and various tools, but not clear what to use or where to start.

3. Once the cert file and key file are created, how do I specific the path to those in the 2 settings in the Calibre Advanced tab? Do I just browse to those files where they're setting on my system to create the path in Calibre settings, or do I need to figure out the virtual path to the Calibre web server content on my system, and copy these files to THAT path?

hollowpoint · 06-19-2021, 09:01 PM

Got this to work, SSL 'https' Internet access to my Calibre content-server. It's nice being able to pull up anything in my library even on mobile phone when away from home, take annotations using Kovid's excellent Calibre reader browser interface, and have all the annotations synced to other devices. And not having to rely on Amazon's cloud and proprietary annotations system.

I will say configuring this is probably not for the non-technical user, unless we can figure out a LOT more streamlined, bulletproof directions for them. Not the hardest thing I've done, but not trivial either, took a couple hours of trial and error this afternoon. In case this is helpful to anyone else, here's the basic steps I went through to get it working on Windows 10.

1. In Calibre Preferences, select Sharing over the Net, enable Require a user name and password, and then create one or more logins on the User Accounts tab.

2. Create an SSL certificate. This sequence of steps was the tricky part, lots of false starts. But the TLDR; version is:

a. Created a free dynamic DNS account at www.no-ip.com. Configure a DNS host name (using one of their provided domains plus a custom server name). This enables you to access to Calibre server without needing to buy a domain name.
b. To get my SSL, I paid for their "Enhanced DNS" service, an annual fee of $24.95 which gives you a number of features, including an SSL certificate: Note: you can optionally create an SSL cert for free here, and in a couple other sites, but I wanted the extra features.
c. Generated a CSR and private key file. For doing this on Windows, there are 2 guides I found most useful
- https://adamtheautomator.com/openssl-windows-10/. Follow the initial install and setup directions to install utilities and create certs locally.
- No-ip's "Generate a CSR" guide, for Apache + OpenSSL (that's the version of the web server that Kovid says is closest to what Calibre runs). https://www.noip.com/support/knowled...pache-openssl/
d. After generating the CSR and key file locally, you select the "Add CSR" option in your no-ip account, select Apache + OpenSSL, and paste in the contents of your CSR file. No-ip then auto-validates your certificate.

3. Install the cert locally. Download the validated cert file from no-ip. I placed both that file, and the private key file, in the .\Calibre2\app folder. Then go into Calibre > Preferences > Sharing over the Net > Advanced, and add the local path to both the cert, and the private key file.

4. In your network router, configure port forwarding to forward from your router's Internet IP to the IP of your Calibre web server. If you don't have a fixed IP (as I don't), then you should ALSO configure dynamic DNS, which you can also get from your no-ip.com account. For me, no-ip is high on convenience because I can do everything I need in one place: create the host/domain name, configure free dynamic DNS server, and generate the SSL cert for my server.

kovidgoyal · 06-19-2021, 09:51 PM

Yes, sadly SSL is a real train wreck designed to prevent democratic use of the internet.

hollowpoint · 06-20-2021, 03:13 AM

For sure. Configuring SSL certs so that the average person could easily host secure web content on a local Windows or Mac installation, is really out of reach I think for most folks.

That said, once you get the cert actually generated and validated by your provider, hooking it up to Calibre is super easy and it works great! I love the idea of being able to just use all Calibre all the time and end my dependency on Amazon's cloud for my annotations.

05-31-2021, 05:39 AM	#1
hollowpoint Groupie Posts: 155 Karma: 6672188 Join Date: Apr 2019 Device: Ipad Mini, Kindle PW5, Libra 2	Trouble configuring SSL for Calibre server on Windows I'm running Calibre 5.19 content server on Win10 x64. Goal is to configure it for internet access with devices. Here's what is working: 1. Configured port forwarding on home network. 2. Created a friendly host name using no-ip.com. 3. Configured a clear text user name and password, log in, and access books. Tested this to confirm it works, but then disabled, as I don't want to leave a port open to my home PC with unencrypted credentials going over the wire. Issue is I haven't been able to create a free SSL cert to use with a non-registered IP address, and configure it in the SSL fields on the Calibre web server Advanced tab. Tried a few different approaches using ZeroSSL with my no-ip friendly domain name, but nothing worked. I'm following the directions here in the Calibre docs, but having issues with the SSL details. Questions: 1. Can you create a free SSL cert to use with just an IP address (it's not actually a registered domain name--I just want to access my books, not create a website)? 2. What's the simplest tool and process to use to generate the certificate and key file to use on Windows? I see a lot of different sites, and various tools, but not clear what to use or where to start. 3. Once the cert file and key file are created, how do I specific the path to those in the 2 settings in the Calibre Advanced tab? Do I just browse to those files where they're setting on my system to create the path in Calibre settings, or do I need to figure out the virtual path to the Calibre web server content on my system, and copy these files to THAT path? Last edited by hollowpoint; 05-31-2021 at 12:54 PM.

06-19-2021, 09:01 PM	#2
hollowpoint Groupie Posts: 155 Karma: 6672188 Join Date: Apr 2019 Device: Ipad Mini, Kindle PW5, Libra 2	Got this to work, SSL 'https' Internet access to my Calibre content-server. It's nice being able to pull up anything in my library even on mobile phone when away from home, take annotations using Kovid's excellent Calibre reader browser interface, and have all the annotations synced to other devices. And not having to rely on Amazon's cloud and proprietary annotations system. I will say configuring this is probably not for the non-technical user, unless we can figure out a LOT more streamlined, bulletproof directions for them. Not the hardest thing I've done, but not trivial either, took a couple hours of trial and error this afternoon. In case this is helpful to anyone else, here's the basic steps I went through to get it working on Windows 10. 1. In Calibre Preferences, select Sharing over the Net, enable Require a user name and password, and then create one or more logins on the User Accounts tab. 2. Create an SSL certificate. This sequence of steps was the tricky part, lots of false starts. But the TLDR; version is: a. Created a free dynamic DNS account at www.no-ip.com. Configure a DNS host name (using one of their provided domains plus a custom server name). This enables you to access to Calibre server without needing to buy a domain name. b. To get my SSL, I paid for their "Enhanced DNS" service, an annual fee of $24.95 which gives you a number of features, including an SSL certificate: Note: you can optionally create an SSL cert for free here, and in a couple other sites, but I wanted the extra features. c. Generated a CSR and private key file. For doing this on Windows, there are 2 guides I found most useful - https://adamtheautomator.com/openssl-windows-10/. Follow the initial install and setup directions to install utilities and create certs locally. - No-ip's "Generate a CSR" guide, for Apache + OpenSSL (that's the version of the web server that Kovid says is closest to what Calibre runs). https://www.noip.com/support/knowled...pache-openssl/ d. After generating the CSR and key file locally, you select the "Add CSR" option in your no-ip account, select Apache + OpenSSL, and paste in the contents of your CSR file. No-ip then auto-validates your certificate. 3. Install the cert locally. Download the validated cert file from no-ip. I placed both that file, and the private key file, in the .\Calibre2\app folder. Then go into Calibre > Preferences > Sharing over the Net > Advanced, and add the local path to both the cert, and the private key file. 4. In your network router, configure port forwarding to forward from your router's Internet IP to the IP of your Calibre web server. If you don't have a fixed IP (as I don't), then you should ALSO configure dynamic DNS, which you can also get from your no-ip.com account. For me, no-ip is high on convenience because I can do everything I need in one place: create the host/domain name, configure free dynamic DNS server, and generate the SSL cert for my server. Last edited by hollowpoint; 06-19-2021 at 09:04 PM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Configuring SSL in Content Server gives Error 13	Pachuqismo	Server	8	06-11-2021 04:46 PM
SSL when running Calibre as local server	passegua	Server	0	01-07-2021 09:57 AM
Calibre Server for Windows and SSL	arcegabriel	Server	7	12-06-2020 10:21 PM
Calibre with SSL, Content Server not loading	aCIDsLAM	Calibre	15	06-26-2017 03:16 AM
calibre-server on vps alongside apache with ssl	g33kdad	Related Tools	2	01-01-2016 12:09 AM

06-19-2021, 09:51 PM	#3
kovidgoyal creator of calibre Posts: 43,963 Karma: 22669822 Join Date: Oct 2006 Location: Mumbai, India Device: Various	Yes, sadly SSL is a real train wreck designed to prevent democratic use of the internet.

06-20-2021, 03:13 AM	#4
hollowpoint Groupie Posts: 155 Karma: 6672188 Join Date: Apr 2019 Device: Ipad Mini, Kindle PW5, Libra 2	For sure. Configuring SSL certs so that the average person could easily host secure web content on a local Windows or Mac installation, is really out of reach I think for most folks. That said, once you get the cert actually generated and validated by your provider, hooking it up to Calibre is super easy and it works great! I love the idea of being able to just use all Calibre all the time and end my dependency on Amazon's cloud for my annotations.

Advert