# Echomark SSL Certificate Issue - Fix

**Issue**: Extension can't connect to Echomark API due to self-signed SSL certificate

---

## The Problem

Chrome is blocking requests from the extension to the Echomark server because the SSL certificate is self-signed and not trusted by the browser.

**Error**: `TypeError: Failed to fetch`

**Root Cause**: Self-signed certificate on `https://ec2-52-8-108-29.us-west-1.compute.amazonaws.com:5345`

---

## Quick Fix: Accept the Certificate

### Step 1: Visit the Echomark Server

Open this URL in Chrome:
```
https://ec2-52-8-108-29.us-west-1.compute.amazonaws.com:5345
```

### Step 2: Accept the Certificate Warning

You'll see a warning: **"Your connection is not private"**

Click: **Advanced** → **Proceed to ec2-52-8-108-29... (unsafe)**

### Step 3: Verify Admin Portal Loads

You should see the **EchoMark Administration Portal** page.

### Step 4: Test the Extension

Now try watermarking a document:
1. Navigate to a Filevine project
2. Click "Protect" on a PDF
3. Fill in recipient information
4. Click "Protect Document"

**Expected**: ✅ Document should watermark successfully!

---

## Why This Works

When you visit the URL and accept the certificate:
- Chrome adds the certificate to its trusted list for this browsing session
- The extension can now make requests to that domain
- CORS headers we configured will allow the extension to communicate

---

## Permanent Solution: Use a Real SSL Certificate

For production deployment, you should use a proper SSL certificate:

### Option 1: Let's Encrypt (Free)

```bash
# SSH into server
ssh -i echomark-api-kp.pem ubuntu@ec2-52-8-108-29.us-west-1.compute.amazonaws.com

# Install certbot
sudo apt update
sudo apt install certbot

# Get certificate (requires domain name)
sudo certbot certonly --standalone -d your-domain.com

# Copy certificates
sudo cp /etc/letsencrypt/live/your-domain.com/fullchain.pem \
  /home/ubuntu/echomark-apiserver-aws-2.0.2.amd64.66dfb1d3ca6d/docker-compose/conf/cert.pem

sudo cp /etc/letsencrypt/live/your-domain.com/privkey.pem \
  /home/ubuntu/echomark-apiserver-aws-2.0.2.amd64.66dfb1d3ca6d/docker-compose/conf/cert.key

# Restart containers
cd /home/ubuntu/echomark-apiserver-aws-2.0.2.amd64.66dfb1d3ca6d/docker-compose
docker compose restart adminserver
```

### Option 2: AWS Certificate Manager

1. Request certificate in AWS Certificate Manager
2. Validate domain ownership
3. Attach to EC2 instance or load balancer
4. Update nginx configuration

### Option 3: Cloudflare (Easy)

1. Add domain to Cloudflare
2. Point DNS to EC2 instance
3. Enable "Full (strict)" SSL
4. Cloudflare handles certificate automatically

---

## Alternative: Disable Certificate Validation (NOT RECOMMENDED)

**⚠️ WARNING**: This is insecure and only for testing!

You could modify the extension to skip certificate validation, but this is a security risk and not recommended for production.

---

## Current Workaround

**For Development/Testing**: Accept the certificate manually before each session:

1. Open new Chrome window/tab
2. Visit: `https://ec2-52-8-108-29.us-west-1.compute.amazonaws.com:5345`
3. Accept certificate warning
4. Use extension normally

**Note**: You may need to do this each time you restart Chrome.

---

## Verifying the Fix

After accepting the certificate, test with this command:

```bash
# From your local machine
curl -k https://ec2-52-8-108-29.us-west-1.compute.amazonaws.com:5345/echomark/api/v2/ping \
  -H "Authorization: Bearer 79f8eaa8-735d-480c-a594-891a9afe9b89"

# Should return:
{"message":"pong"}
```

Then reload the extension and try watermarking.

---

## Summary

**Problem**: Self-signed SSL certificate
**Quick Fix**: Visit URL in browser and accept certificate
**Permanent Fix**: Install proper SSL certificate (Let's Encrypt recommended)

**Try this now**: Open `https://ec2-52-8-108-29.us-west-1.compute.amazonaws.com:5345` and accept the certificate!
