Jun 28 00:56:24 amnesia prosody[19146]: certmanager: SSL/TLS: Failed to load '/etc/prosody/certs/youronionaddress.key': Check that the file exists and the permissions are correct (for myonion.onion)
Jun 28 00:56:24 amnesia prosody[19146]: myonion.onion:tls: Error creating context for c2s: error loading private key ((null))
I am a retard. I am getting the errors above after running "sudo journalctl -u prosody -xe" . Do I need to redo a step?
if anyone else gets the same error, follow those steps.
you're not a retard, a lot of people get this step wrong.
PM me you got a step wrong
but its probably just that you didnt out run sudo prosodyctl cert generate youronionaddress.onion with your real onion address you generated earlier.
Check the folder: sudo ls -la /etc/prosody/certs/
you should see:
myonion.onion.crt
myonion.onion.key
If those don’t exist, re-run:
sudo prosodyctl cert generate myonion.onion
but make sure you put your real onion address thats geberated earlier.
also check you might need to fix file permissions. run this:
sudo chown prosody:prosody /etc/prosody/certs/myonion.onion.*
sudo chmod 640 /etc/prosody/certs/myonion.onion.key
make sure the folder is owned by Prosody:
sudo chown -R prosody:prosody /etc/prosody/certs
i said last one in the PM i sent, but incase other people get this error too, ill say it on here too,
Confirm your VirtualHost config:
sudo nano /etc/prosody/conf.avail/myonion.onion.cfg.lua
make sure it has the correct lines:
ssl = {
key = "/etc/prosody/certs/myonion.onion.key";
certificate = "/etc/prosody/certs/myonion.onion.crt";
}
again, make sure you change the myonion.onion.key to your onion address you generated plus the .key,
If you left youronionaddress.onion literally, it will fail to find its certs.
also make sure you edited the etc/prosody/prosody.cfg.lua file with your onion address you generated, alot of people forget to replace it. edit the file like this :
sudo nano /etc/prosody/conf.avail/myonion.onion.cfg.lua
then find the part that says:
VirtualHost "youronionaddress.onion" and change it to your address you geneterated earlier.
then restart prosody:
sudo systemctl restart prosody
then check again:
sudo journalctl -u prosody -xe
If it still fails, then enter:
sudo ls -la /etc/prosody/certs/
sudo cat /etc/prosody/conf.avail/myonion.onion.cfg.lua
and then i can help you further. but that should fix it.
nice guide bro really solid. just a quick add for anyone using a vps setup make sure the hidden service folder like /var/lib/tor/xmpp_hidden has the right ownership or tor won’t generate the .onion. do chown -R debian-tor:debian-tor on it then restart tor.... also if federation fails check that port 5269 is allowed locally even if it's not public. had that issue before :)
Please edit it into the post. This post is going to end up in our wiki somewhere. It's better if people don't have to look in the comments to get it right.
This is the Braille Blank. Dread ignores two spaces on a line together. It ignores multiple blank lines, too. One of these on a line means it's not blank, even though you can't see it.
https://www.compart.com/en/unicode/U+2800
thanks bro this is great cuz ive been going thorugh so many xmpp accounts cuz the ones i use always end up going offline or their certificates expiring or some bullshit this is gonna help a lot of people , upvoted
Solid write-up. Good to see a guide that actually covers s2s federation and AppArmor — most people skip that part.
One thing worth mentioning:
if you're aiming for stronger metadata protection during federation, combining s2s_whitelist with mod_limits and custom cert pinning helps filter out noisy peers and reduces exposure surface.
Also — always watch out for memory leaks with some Prosody modules under high-load Tor connections. Seen a few setups crumble over time because of that.
Respect for putting this together.
Running onion-native XMPP is niche, but damn powerful when hardened correctly. Privacy is everything.🛡️
this guide works on Tails OS too! Tails is just a security-hardened Linux system, so all the steps for installing Prosody, Tor, and setting up your onion XMPP server are the same as on any Debian based Linux.
Just a couple Tails-specific tips:
Make sure you enable “Additional Software” persistence if you want your server to survive a reboot, since Tails wipes most changes on shutdown by default. Otherwise, you’ll have to reinstall everything after every boot.
Some directories (like /var/lib/tor/) are not persistent by default in Tails, so you’ll need to either configure persistent storage for them or recreate your onion service each session.
You might want to generate your .onion address and Prosody configs on Tails, then copy them to a more permanent system if you plan to run the server 24/7 (since Tails is usually used as a live OS).
Otherwise, all the steps in my guide work on Tails, and it’s a good choice for anonymity if you want to set up and test an onion server safely!
PM me if you want a step-by-step specifically for Tails persistence, or if you get stuck anywhere. I’m happy to help :)
I wonder if you can provide any specific advice for doing this on Qubes?
Which appVM or template to work inside?
Should I setup a seperate VM just for the jabber server or have it running inside the general wonix-anon-work appVM.
Would like to know before I start screwing up my system.
Doing it in Qubes is possible, but honestly it’ll run much smoother in a regular Debian or Ubuntu VM.
If you really need to set it up on Qubes, let me know and I can walk you through it, just message me :)
Thanks for the offer, Im not gonna bother if its gonna get janky. I find Qubes twists itself up enough already, I usually have to fresh install every so often so that would be one more set of hoops to go through to get it running again. thanks anyway, good boy.
its a jabber sever, jabber is a messaging app. but instead of using clearnet domains like xmpp.is or other servers, you make your own server with a onion address, so like m5vxclee556d3ndcjmtn3uwa62r6rh6fi7okye77hyfbzfuhtbo5pkid.onion at the end instead of xmpp.is
it routs your traffic through tor so your anonymous and cant be tracked. and also you can add specific features too prosody, unlike clearnet servers (as i mentioned in the guide)
im not familiar with ransomware, but you might be able too, since this guide makes a onion server.
Jun 28 00:56:24 amnesia prosody[19146]: myonion.onion:tls: Error creating context for c2s: error loading private key ((null))
I am a retard. I am getting the errors above after running "sudo journalctl -u prosody -xe" . Do I need to redo a step?
you're not a retard, a lot of people get this step wrong.
PM me you got a step wrong
but its probably just that you didnt out run sudo prosodyctl cert generate youronionaddress.onion with your real onion address you generated earlier.
Check the folder: sudo ls -la /etc/prosody/certs/
you should see:
myonion.onion.crt
myonion.onion.key
If those don’t exist, re-run:
sudo prosodyctl cert generate myonion.onion
but make sure you put your real onion address thats geberated earlier.
also check you might need to fix file permissions. run this:
sudo chown prosody:prosody /etc/prosody/certs/myonion.onion.*
sudo chmod 640 /etc/prosody/certs/myonion.onion.key
make sure the folder is owned by Prosody:
sudo chown -R prosody:prosody /etc/prosody/certs
i said last one in the PM i sent, but incase other people get this error too, ill say it on here too,
Confirm your VirtualHost config:
sudo nano /etc/prosody/conf.avail/myonion.onion.cfg.lua
make sure it has the correct lines:
ssl = {
key = "/etc/prosody/certs/myonion.onion.key";
certificate = "/etc/prosody/certs/myonion.onion.crt";
}
again, make sure you change the myonion.onion.key to your onion address you generated plus the .key,
If you left youronionaddress.onion literally, it will fail to find its certs.
also make sure you edited the etc/prosody/prosody.cfg.lua file with your onion address you generated, alot of people forget to replace it. edit the file like this :
sudo nano /etc/prosody/conf.avail/myonion.onion.cfg.lua
then find the part that says:
VirtualHost "youronionaddress.onion" and change it to your address you geneterated earlier.
then restart prosody:
sudo systemctl restart prosody
then check again:
sudo journalctl -u prosody -xe
If it still fails, then enter:
sudo ls -la /etc/prosody/certs/
sudo cat /etc/prosody/conf.avail/myonion.onion.cfg.lua
and then i can help you further. but that should fix it.