# Trytond dies with SSL ca\_certs implimentation
**URL:** https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919
**Category:** System Administrator
**Created:** [June 24, 2020, 11:53am UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919 "2020-06-24T11:53:59Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [June 24, 2020, 11:53am UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/1 "2020-06-24T11:53:59Z")
I have copied the contents of the (non OS ssl) privkey.pem into the fullchain.pem to create the /home/me/.config/tryton/x.y/ca\_certs file. I then declared it in the trytond.conf with “SSLContext.load\_cert\_chain(/home/me/.config/tryton/x.y/ca\_certs)” I am not sure if this is where SSLContext.load\_cert\_chain should be defined but couldn’t find any information to that effect. When gnuhealth is run it dies with this error:
systemd[1]: Started GNU Health server.
trytond[11389]: Traceback (most recent call last):
trytond[11389]: extra\_files = config.update\_etc(options.configfile)
trytond[11389]: File “/usr/lib/python3.6/site-packages/trytond/config.py”, line 107, in update\_etc
trytond[11389]: read\_files = self.read(configfile)
trytond[11389]: File “/usr/lib64/python3.6/configparser.py”, line 697, in read
trytond[11389]: self.\_read(fp, filename)
trytond[11389]: File “/usr/lib64/python3.6/configparser.py”, line 1111, in \_read
trytond[11389]: raise e
trytond[11389]: configparser.ParsingError: Source contains parsing errors: ‘/etc/tryton/trytond.conf’
trytond[11389]: #011[line 60]: ‘SSLContext.load\_cert\_chain(/home/me/.config/tryton/x.y/ca\_certs)\n’
systemd[1]: gnuhealth.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: gnuhealth.service: Unit entered failed state.
systemd[1]: gnuhealth.service: Failed with result ‘exit-code’.
systemd[1]: gnuhealth.service: Service RestartSec=100ms expired, scheduling restart.
systemd[1]: Stopped GNU Health server.
systemd[1]: gnuhealth.service: Start request repeated too quickly.
systemd[1]: Failed to start GNU Health server.
systemd[1]: gnuhealth.service: Unit entered failed state.
systemd[1]: gnuhealth.service: Failed with result ‘exit-code’.
sshd[11334]: pam\_unix(sshd:session): session closed for user root
systemd-logind[1342]: Session 87 logged out. Waiting for processes to exit.
systemd-logind[1342]: Removed session 87.
sshd[11397]: Accepted keyboard-interactive/pam for root from 192.168.1.107 port 50177 ssh2
systemd-logind[1342]: New session 88 of user root.
systemd[1]: Started Session 88 of user root.
sshd[11397]: pam\_unix(sshd:session): session opened for user root by (uid=0)
Could you please advise on what I’m doing wrong and how to sort it.
Thank you
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [June 24, 2020, 12:44pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/2 "2020-06-24T12:44:10Z")
The configuration file should not contain any code.
But to activate SSL, you just need to set [private key](https://docs.tryton.org/projects/server/en/latest/topics/configuration.html#privatekey) and [certificate](https://docs.tryton.org/projects/server/en/latest/topics/configuration.html#certificate) paths.
But for production setup, it is recommended to use a proxy (link [nginx](https://www.nginx.com/)) to deal with SSL.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [June 24, 2020, 1:55pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/3 "2020-06-24T13:55:57Z")
Actually, I initially set the paths to the key and certificate in tryton.conf before going the SSLContext.load\_cert\_chain way but that also threw an error like:
systemd[1]: Started GNU Health server.
trytond[21214]: Traceback (most recent call last):
trytond[21214]: use\_reloader=options.dev)
trytond[21214]: File “/usr/lib/python3.6/site-packages/werkzeug/serving.py”, line 833, in run\_simple
trytond[21214]: inner()
trytond[21214]: File “/usr/lib/python3.6/site-packages/werkzeug/serving.py”, line 793, in inner
trytond[21214]: fd=fd)
trytond[21214]: File “/usr/lib/python3.6/site-packages/werkzeug/serving.py”, line 679, in make\_server
trytond[21214]: passthrough\_errors, ssl\_context, fd=fd)
trytond[21214]: File “/usr/lib/python3.6/site-packages/werkzeug/serving.py”, line 602, in **init**
trytond[21214]: self.socket = ssl\_context.wrap\_socket(sock, server\_side=True)
trytond[21214]: File “/usr/lib/python3.6/site-packages/werkzeug/serving.py”, line 512, in wrap\_socket
trytond[21214]: ssl\_version=self.\_protocol, \*\*kwargs)
trytond[21214]: File “/usr/lib64/python3.6/ssl.py”, line 1158, in wrap\_socket
trytond[21214]: ciphers=ciphers)
trytond[21214]: File “/usr/lib64/python3.6/ssl.py”, line 750, in **init**
trytond[21214]: self.\_context.load\_cert\_chain(certfile, keyfile)
trytond[21214]: PermissionError: [Errno 13] Permission denied
systemd[1]: gnuhealth.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: gnuhealth.service: Unit entered failed state.
systemd[1]: gnuhealth.service: Failed with result ‘exit-code’.
systemd[1]: gnuhealth.service: Service RestartSec=100ms expired, scheduling restart.
systemd[1]: Stopped GNU Health server.
systemd[1]: Started GNU Health server.
sshd[21222]: Accepted keyboard-interactive/pam for root from 192.168.1.107 port 52141 ssh2
systemd[1]: Started Session 99 of user root.
systemd-logind[1342]: New session 99 of user root.
sshd[21222]: pam\_unix(sshd:session): session opened for user root by (uid=0)
I am new to Tryton. Will appreciate if you could explain clearly how to deal with this.
Thank you.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [June 24, 2020, 2:01pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/4 "2020-06-24T14:01:05Z")
> [@smoothsg](#):
>
> trytond[21214]: PermissionError: [Errno 13] Permission denied
Clearly an access right issue.
---
### Author:  [@smoothsg](https://discuss.tryton.org/u/smoothsg)
#### Post date: [June 24, 2020, 2:39pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/5 "2020-06-24T14:39:08Z")
Thanks for your reply but it is not helpful to me considering my request above.
Before posting for help, I’ve seen the reference to the PermissionError: and I have given both the directory and the the two files involved chmod 777 but tryton is still not permitted (got the same error) which is why I requested you to tell me clearly what needs to be done if you know it so it doesn’t have to take me another five questions or so to get there. Thanks
---
### Author:  [@fransuar](https://discuss.tryton.org/u/fransuar)
#### Post date: [January 13, 2021, 10:21pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/6 "2021-01-13T22:21:06Z")
Hello. I am having a similar issue.
I already installed and set nginx. I am still learning on how to set up ssl on trytond.
I need to know if this is the way to set the graphic client to go trough ssl.
Thanks
---
### Author:  [@German](https://discuss.tryton.org/u/German)
#### Post date: [January 14, 2021, 1:11am UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/7 "2021-01-14T01:11:41Z")
Actually you dont need ssl on trytond if you’re behind the proxy, just use https between client and nginx and leave trytond without ssl. In this forum are some topics about how configure nginx for tryton
---
### Author:  [@fransuar](https://discuss.tryton.org/u/fransuar)
#### Post date: [January 14, 2021, 7:09pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/9 "2021-01-14T19:09:53Z")
Hi! Thanks for the quick response.
I have seen many post, but actually I have no clue on how to set it up.
Is there any step-by-step on how to configure nginx without using docker?
---
### Author:  [@German](https://discuss.tryton.org/u/German)
#### Post date: [January 14, 2021, 7:37pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/10 "2021-01-14T19:37:58Z")
Check this post, it has the server block example for nginx and trytond.
> [@How to setup SSL for Tryton](https://discuss.tryton.org/t/how-to-setup-ssl-for-tryton/2408/4):
>
> @ced coincidentally, that’s exactly the setup I built for TLS/HTTPS. I’ve read that tutorial before. slight_smile You guys are very fast with your responses. It’s greatly appreciated. Here’s my Docker-Compose / Nginx / Let’s Encrypt / Tryton setup if anyone else is searching for exactly how to do it. If I’ve omitted any details, see the Medium article @ced mentioned [here](https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71). First the Nginx and Certbot containers in my docker-compose.yml file: trytond: container\_name: trytond # Server …
---
### Author:  [@fransuar](https://discuss.tryton.org/u/fransuar)
#### Post date: [January 14, 2021, 7:42pm UTC](https://discuss.tryton.org/t/trytond-dies-with-ssl-ca-certs-implimentation/2919/11 "2021-01-14T19:42:29Z")
Thanks! I was just looking at the same post.
That configuration works on tryton gtk client (not sao)?