Problem with Alexa Certificate

[djerniehoule 23]

I too am having this issue where when I ask alexa to launch Emby it says "sorry i'm having trouble accessing your emby skill right now"

[Luke 42077]

On 3/16/2024 at 1:01 PM, djerniehoule said:

I too am having this issue where when I ask alexa to launch Emby it says "sorry i'm having trouble accessing your emby skill right now"

HI, what are you saying to alexa?

[djerniehoule 23]

Alexa launch Emby, then shuffle a genre. It says something about http 

Edited March 17, 2024 by djerniehoule

[djerniehoule 23]

This is what I get when I ask Alexa to play music from Emby..

[djerniehoule 23]

Can some provide detailed instructions on how to get Emby to play music through Alexa? All I get is this when I ask…

[Luke 42077]

6 hours ago, djerniehoule said:

Can you explain the steps? I have tried, but think I did it all all wrong

Hi there, have you setup ssl for your Emby Server? If so, then where did your SSL certificate come from?

[djerniehoule 23]

I have no idea how to do that?

[ginjaninja 605]

1 hour ago, djerniehoule said:

I have no idea how to do that?

this might get you started...needs a bit of perseverance

 

[djerniehoule 23]

Been trying this, has anyone had success and would lay out the steps?

[ginjaninja 605]

1 hour ago, djerniehoule said:

Been trying this, has anyone had success and would lay out the steps?

if your exposing the emby server public port directly to internet i can try and fill in the blanks when your stuck. I cant help with reverse proxy setups..(there is a link to a reverse proxy guide in the linked post above if thats the way you intend to go,). Reverse proxy is likely better but requires more infrastructure and technical setup  / know how. 

Assuming the former have you a domain name? you can register one for free at dynu (suggest you do  not include public IPs / domain names in public view on forum)

 

 

[djerniehoule 23]

Need a simpler way to do this, plex just works, I don't have to purchase a domain name..

[Luke 42077]

23 minutes ago, djerniehoule said:

Need a simpler way to do this, plex just works, I don't have to purchase a domain name..

@djerniehouledon't you want a personal media server and not one that puts your information into the cloud?

[djerniehoule 23]

Sure, but we have to pay for this? I keep seeing free, but not finding that option..

[djerniehoule 23]

Am I understanding this correctly? to make this work we need our own domain? which we pay for? I just want to be sure I am understanding this correctly..

[ginjaninja 605]

11 hours ago, djerniehoule said:

Sure, but we have to pay for this? I keep seeing free, but not finding that option..

 

there are lots of free ddns services which provide a third level domain to providers second level. dynu is free...suggest step 1 is sign up for dynu ddns and register a domain name..

example 1wanthisunusedthirddomainname.mywire.org (mywire.org is one of the free 2nd level domain parents dynu offers)

 

edit yes you need a domain name because the certificate that you request eg via free zerossl will be for this domain name....

edit one of the ways client browsers and alexa services and such confirm the validity of the website/webservice/emby, is when they talk to yourdomain.mywire.org they hit a webservice which provides a certificate trusted by the client and purporting to be for yourdomain.mywire.org (and not a certificate for malware.otherdomain.com)

 

Edited March 20, 2024 by ginjaninja

[djerniehoule 23]

Ok, but initially I have to pay for a domain of my choosing?

[ginjaninja 605]

50 minutes ago, djerniehoule said:

Ok, but initially I have to pay for a domain of my choosing?

for clarity NO...

Spoiler

you can purchase your own domain but it is not necessary,

i  suggest you opt for the free dynu ddns service...

and register your third level subdomain under one of dynu free 2nd level domains (did i mention for free )

[djerniehoule 23]

Is this only good for 90 days, then you have to repeat procedure?

[ginjaninja 605]

On 20/03/2024 at 13:24, djerniehoule said:

Is this only good for 90 days, then you have to repeat procedure?

There are elements of the solution that need to be refreshed but they can all be automated...

for clarity i set mine up a few years ago and have never touched it since..

 

dynu has client tools (alternatively some routers have inbuilt update tools for ddns) which can update the IP address <> domain mapping (if you dont have a static ip).

(the ip address for your dynu domain should be the public ip address of your emby service)

The certify the web client can automate the certificate renewal but thats step 3

 

So the Free Dynu/ZeroSSL/CertifytheWeb (CTW) method for automated certificate renewal has the following elements. (simplest for Wwindows servers)

• Register a domain with Dynu DDNS service and note your Dynu Client id and Secret
• Install Dynu IP update client (automates IP address <> Domain update)
• Register with ZeroSSL and note the ZeroSSL KeyID/Key
• Install CTW client, add ZeroSSL, Dynu and Certificate PFX password  credentials to CTW
• Configure CTW to request a certificate for your Dynu domain and export it to a location Emby can be made aware of. (Auto renewal is enabled by default)
• Request Certificate.
• Configure Emby with Certificate Path and Certificate password under Emby Network Settings.
• [Out of scope of this post] Ensure Emby remote access settings, secure users with strong passwords, ensure Emby server public port is published/nated on your WAN interface

 

so (Step 1)

have you registered a domain name with dynu's ddns service?

 

Step 2

do you have a static ip?  if not i suggest you use the dynu client service to keep the ip address associated to the domain up to date. im on windows so its easy as there is a windows Dynu client.

 

Edited March 22, 2024 by ginjaninja

[djerniehoule 23]

ok, I am at a step:

 

Follow the steps below

To verify your domain using a CNAME record, please follow the steps below:

1. Sign in to your DNS provider, typically the registrar of your domain.
2. Navigate to the section where DNS records are managed.
3. Add the following CNAME record:
   • Name_2519B0C74559643A78126F7BEFB61D9A.mocaba.ddnsfree.com
   • Point ToC9710039D86244B404ED9106634B34A9.8CFC7F6C1AF225E4EBC5FDC2D9345E7D.d63e55730354ee9.comodoca.com
   • TTL3600 (or lower)
4. Save your CNAME record and click "Next Step" to continue.

Where do I put this info?

[ginjaninja 605]

ah ok your following the emby guide...I am more familiar with the certify the web client/zero ssl (in the linked post) as it has all this functionality built in..and does the certificate  autorenewal (dont know if 'SSL for free' has autorenewal functionality?)

certify the web  client supports the following authorities for auto renewal.. (I used zerossl authority with certifythewebclient for autorenewal)

that said if you want to persevere with the emby guide, you will need to enter the dns information here in dynu control panel. (fwiw the certify the web client can automatically populate the verification records into dynu)

Spoiler

that also said once you have got it working with an 'ssl for free' certifcate you will be 95% there  (in terms of understanding and 75% in terms of work) if you wanted to move to certify the web

 

Spoiler

In practical terms the "ssl for free" service is checking you own the domain by virtue of you being able to put the codes (aka dns records)  into namespace which it can then check (via a dns lookup)...

so do you want to go SSL for free/Emby guide or Zero SSL/Certifytheweb ?

 

[djerniehoule 23]

I am on Zerossl, but was looking at Emby instructions

[ginjaninja 605]

ok ill walk you through using certify the web (CTW) and zerossl.

Step 3 - Obtain your Dynu client id and secret key within the Dynu control panel

you may have to generate it

This is the username/ password that will allow the CTW client to update DYNU with the verification records

Step 4 Install the CTW Client

Do you have access to a windows computer with access to the pathway where Emby stores the certificate....you need to install the CTW client and then we'll configure it later.

if you dont have a windows computer then well have to take stock..

 

Edited March 20, 2024 by ginjaninja

[djerniehoule 23]

I am on that page and yes I have windows

 

[ginjaninja 605]

On 20/03/2024 at 14:34, djerniehoule said:

I am on that page and yes I have windows

 

Step 5

with your dynu clientid/secret in hand and the CTW client installed

you need to configure CTW to request a certificate from zerossl..

 

5a - Register with zerosll

visit zero sll's  Develop tab fpr generating of 'EAB Credentials for ACME clients' , generate the KEY ID and KEY  will be needed when you add the ZeroSSL account to CTW.

 

5b - tell CTW about Zerosll

 under CTW...settings....certificate authority.. add  [new account] ..this is what mine looks like.

 

add keyid and key from the Zerossl website/developer tab..click regiter contact

 

Edited March 22, 2024 by ginjaninja