How to Install SSL on R1Soft Backup Manager Using Certbot

By default, R1Soft Server Backup Manager (SBM) ships with a self-signed SSL certificate on port 443 (or custom port 8443). Browsers display severe security warnings, and automated API scripts frequently fail SSL certificate validation. Installing a trusted Let’s Encrypt SSL certificate using Certbot resolves browser warnings and encrypts administrative sessions.

Production Note: R1Soft runs an embedded Java web server. Certbot issues standard PEM format certificates (fullchain.pem and privkey.pem), which must be converted into a Java KeyStore (JKS) or PKCS#12 keystore file before R1Soft’s embedded web container can read them.

At a Glance

Ensure the Backup Manager domain resolves via public DNS and port 80/443 are open.
Install Certbot on the Backup Manager host.
Issue a Let’s Encrypt certificate in standalone or webroot mode.
Convert the PEM certificates into a PKCS#12 bundle using OpenSSL.
Import the bundle into R1Soft’s Java keystore.
Configure R1Soft configuration files (server.conf or web interface settings).
Restart the cdp-server service and verify HTTPS in a web browser.
Set up an automated renewal script in /etc/letsencrypt/renewal-hooks/deploy/.

Prerequisites

Before starting, confirm the following requirements:

Root access to the server hosting R1Soft Server Backup Manager.
A fully qualified domain name (FQDN), such as backup.yourdomain.com, pointing to the Backup Manager’s public IP.
Inbound TCP port 80 open on firewalls to satisfy the Let’s Encrypt HTTP-01 domain validation challenge.
Java development tools (keytool) and openssl installed on the host.

Step 1: Verify DNS Resolution and Open Firewall Ports

Verify that your Backup Manager domain resolves to the correct public IP from the server itself:

# Verify DNS resolution
dig +short backup.yourdomain.com

Ensure that ports 80 and 443 are permitted in your system firewall:

# For AlmaLinux / Rocky Linux / RHEL (firewalld):
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

# For Ubuntu / Debian (UFW):
ufw allow 80/tcp
ufw allow 443/tcp
ufw reload

Step 2: Install Certbot and Dependencies

Install Certbot using the appropriate package manager for your operating system:

# On Ubuntu / Debian:
apt update
apt install -y certbot openssl openjdk-17-jre-headless

# On AlmaLinux / Rocky Linux / RHEL 8 or 9:
dnf install -y epel-release
dnf install -y certbot openssl java-latest-openjdk-headless

Step 3: Issue the Let’s Encrypt Certificate

If R1Soft is currently listening on port 80 or 443, you must either temporarily stop the service or use Certbot’s standalone mode:

# Temporarily stop R1Soft if it binds to port 80
systemctl stop cdp-server

# Request the Let's Encrypt SSL certificate
certbot certonly --standalone -d backup.yourdomain.com --non-interactive --agree-tos -m admin@yourdomain.com

Expected output:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/backup.yourdomain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/backup.yourdomain.com/privkey.pem

Step 4: Convert PEM Certificates to Java PKCS#12 Keystore

R1Soft Backup Manager reads SSL keys from a Java KeyStore. Use openssl to bundle the private key, certificate, and intermediate chain into a PKCS#12 file:

# Create a dedicated directory for R1Soft SSL certificates
mkdir -p /usr/sbin/r1soft/conf/ssl
cd /etc/letsencrypt/live/backup.yourdomain.com/

# Convert PEM to PKCS12 format (define a secure keystore password)
openssl pkcs12 -export \
  -in fullchain.pem \
  -inkey privkey.pem \
  -out /usr/sbin/r1soft/conf/ssl/keystore.p12 \
  -name r1soft \
  -passout pass:r1softpassword

Verify that the generated keystore file is readable by the R1Soft system user:

chmod 600 /usr/sbin/r1soft/conf/ssl/keystore.p12

Step 5: Configure R1Soft Web Server SSL Settings

You can configure R1Soft to load the keystore either via the command line or through server.conf.

Option A: Using the R1Soft Configuration Utility (Recommended)

Run the R1Soft CLI configuration tool to set the keystore path and password:

# Update keystore path and password via R1Soft CLI
r1soft-setup --keystore-path /usr/sbin/r1soft/conf/ssl/keystore.p12 \
  --keystore-password r1softpassword \
  --http-port 80 \
  --https-port 443

Option B: Editing `server.conf` Directly

Open the primary R1Soft server configuration file:

nano /usr/sbin/r1soft/conf/server.conf

Verify and update the SSL configuration directives:

# R1Soft Web Server SSL Settings
keystore.path=/usr/sbin/r1soft/conf/ssl/keystore.p12
keystore.password=r1softpassword
keystore.type=PKCS12
https.enabled=true
https.port=443
http.port=80

Save the file and exit the editor.

Step 6: Restart R1Soft Backup Manager and Verify HTTPS

Restart the R1Soft Backup Manager daemon to apply the new SSL certificate:

systemctl restart cdp-server

Verify that the service is running and listening on port 443:

systemctl status cdp-server
ss -tulpn | grep -E ':(80|443)'

Open your web browser and navigate to https://backup.yourdomain.com. You should see the secure lock icon without any browser security warnings.

Step 7: Configure Automated Renewal Hook

Let’s Encrypt certificates expire every 90 days. To ensure R1Soft automatically reloads the renewed certificate without manual intervention, create a renewal deploy hook:

Create the script file:

nano /etc/letsencrypt/renewal-hooks/deploy/r1soft-reload.sh

Add the following automated conversion and restart script:

#!/bin/bash
DOMAIN="backup.yourdomain.com"
KEYSTORE_DIR="/usr/sbin/r1soft/conf/ssl"
PASSWORD="r1softpassword"

if [ "$RENEWED_LINEAGE" = "/etc/letsencrypt/live/$DOMAIN" ]; then
    echo "[$(date)] Converting renewed Let's Encrypt certificate for R1Soft..."
    
    openssl pkcs12 -export \
      -in "/etc/letsencrypt/live/$DOMAIN/fullchain.pem" \
      -inkey "/etc/letsencrypt/live/$DOMAIN/privkey.pem" \
      -out "$KEYSTORE_DIR/keystore.p12" \
      -name r1soft \
      -passout pass:$PASSWORD
      
    chmod 600 "$KEYSTORE_DIR/keystore.p12"
    
    echo "[$(date)] Restarting R1Soft Backup Manager..."
    systemctl restart cdp-server
fi

Make the script executable:

chmod +x /etc/letsencrypt/renewal-hooks/deploy/r1soft-reload.sh

Test the renewal process with a dry run:

certbot renew --dry-run

Troubleshooting

Problem: “Problem binding to port 80: Could not bind to IPv4 or IPv6”

Possible cause: Another web server (Apache, Nginx, or an existing R1Soft instance) is actively listening on TCP port 80.

Check:

ss -tulpn | grep :80

Solution: Temporarily stop the conflicting service before running Certbot standalone, or configure Certbot to use the webroot plugin:

systemctl stop nginx  # or systemctl stop httpd
certbot renew
systemctl start nginx

Problem: “java.io.IOException: Keystore was tampered with, or password was incorrect”

Possible cause: The password passed to openssl pkcs12 -passout does not match the password defined in server.conf or r1soft-setup.

Check: Inspect /usr/sbin/r1soft/conf/server.conf for matching keystore.password.

Solution: Re-export the PKCS12 file and ensure the exact same password is configured in server.conf.

Problem: “SSL handshake failure or ERR_SSL_PROTOCOL_ERROR in browser”

Possible cause: The keystore.type is set to JKS in server.conf while the file was exported as PKCS12.

Check: Inspect the keystore format:

file /usr/sbin/r1soft/conf/ssl/keystore.p12

Solution: Ensure keystore.type=PKCS12 is specified in server.conf.

Verify the Configuration

Test the live SSL handshake from the command line:

# Inspect certificate details and expiration date
openssl s_client -connect backup.yourdomain.com:443 -servername backup.yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -issuer -subject

Expected output confirms the Let’s Encrypt CA and validity dates:

notBefore=Sep  6 12:00:00 2026 GMT
notAfter=Dec  5 12:00:00 2026 GMT
issuer=C = US, O = Let's Encrypt, CN = R3
subject=CN = backup.yourdomain.com

Production Checklist

Verified DNS A record points to Backup Manager IP (dig +short).
Permitted inbound port 80 and 443 in system firewall rules.
Obtained Let’s Encrypt certificate via Certbot.
Converted PEM certificates to PKCS#12 format with secure password.
Updated R1Soft server.conf with keystore path and password.
Restarted cdp-server and verified web UI renders with valid SSL lock.
Deployed renewal hook in /etc/letsencrypt/renewal-hooks/deploy/.
Verified certbot renew --dry-run completes successfully.

Frequently Asked Questions

Can I use a wildcard SSL certificate with R1Soft Backup Manager?

Yes. You can issue a wildcard certificate (*.yourdomain.com) using Certbot with the DNS-01 challenge plugin (e.g., Cloudflare, Route53), convert the resulting PEM files to PKCS12, and configure R1Soft as outlined above.

What happens if the Let’s Encrypt certificate expires?

If the certificate expires, the R1Soft Backup Manager daemon continues running, but administrators will receive browser warnings and API integrations may reject SSL handshakes. The automated renewal deploy hook created in Step 7 prevents expiration.

Can I run Nginx as a reverse proxy in front of R1Soft instead?

Yes. Many administrators configure Nginx to listen on port 443 with standard Let’s Encrypt certificates and proxy traffic to R1Soft running on an internal port (e.g., http://127.0.0.1:8080). This avoids Java keystore conversions entirely.

Need Help Securing Your Backup Infrastructure?

If you need assistance hardening your backup servers, configuring zero-trust network access, or automating multi-cluster SSL certificates, connect with our infrastructure operations team.