title: Unable to use Let's Encrypt cert in Telegram bot webhook (Self-Signed cert works fine)
body: <p>I am trying to setup my <strong>Telegram bot webhook</strong> using a <strong>Let's Encrypt certificate</strong> but Telegram keeps saying <em>verification_failed</em>. Browsers, however, are totally fine with new Let's Encrypt certificate.</p>
  
  <p>My self-signed certificate is currently working fine in webhooks on my <em>Ubuntu 17.04</em> with <em>Nginx web server</em>.</p>
  
  <p>What am i missing?</p>
  
  <h3>Current self-signed certificate setup (Works)</h3>
  
  <p>I generated my certificate using this command:</p>
  
  <pre><code>openssl req -newkey rsa:2048 -sha256 -nodes -keyout my-cert.key -x509 -days 365 -out my-cert.pem -subj "/C=CA/ST=Ontario/L=Toronto/O=My Organization/CN=example.org"
  </code></pre>
  
  <p>and Nginx configuration:</p>
  
  <pre><code>server {
      server_name example.org www.example.org localhost;
  
      listen 443  ssl;
      listen 8080 ssl;
      listen 8443 ssl;
  
      ssl_certificate     /etc/nginx/certificates/my-cert.pem;
      ssl_certificate_key /etc/nginx/certificates/my-cert.key;
  
      ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
      ssl_prefer_server_ciphers on;
  
      location ~* ^/bots/mybot/webhook/.+$ {
          proxy_pass          http://0.0.0.0:5000;
          proxy_http_version  1.1;
          proxy_set_header    Upgrade $http_upgrade;
          proxy_set_header    Connection keep-alive;
          proxy_set_header    Host $host;
          proxy_cache_bypass  $http_upgrade;
          proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
      }
  }
  </code></pre>
  
  <h3>New Let's Encrypt setup (Works in browsers, Fails in webhooks)</h3>
  
  <p>Certificate is generated for my domain using EFF's great certbot.</p>
  
  <p>When setting Telegram's webhook, I use <code>/etc/letsencrypt/live/example.org/cert1.pem</code> file.</p>
  
  <p>This is Nginx configuration I tried:</p>
  
  <pre><code>server {
      server_name example.org www.example.org localhost;
  
      listen  80;
      listen  [::]:80;
  
      root /var/www/html;
      index index.html index.htm index.nginx-debian.html;
  
      if ($scheme != "https") {
          return 301 https://$host$request_uri;
      }
  }
  
  server {
      server_name example.org www.example.org localhost;
  
      listen 443  ssl;
      listen 8080 ssl;
      listen 8443 ssl;
  
      ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; # managed by Certbot
  
      ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
      ssl_prefer_server_ciphers on;
  
      location ~* ^/bots/mybot/webhook/.+$ {
          proxy_pass          http://0.0.0.0:5000;
          proxy_http_version  1.1;
          proxy_set_header    Upgrade $http_upgrade;
          proxy_set_header    Connection keep-alive;
          proxy_set_header    Host $host;
          proxy_cache_bypass  $http_upgrade;
          proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
      }
  }
  </code></pre>