SSL cert installation for admin area

Discussion in 'Installation/Configuration' started by lubos, Apr 7, 2009.

  1. lubos

    lubos New Member

    SOLVED: SSL cert installation for admin area

    I know there is lots of threads about this and I read trough them last 2 days and used a lot of suggestions but could not find help.

    I have class2 certificate from startssl.com named ssl.crt
    I downloaded their certificates:
    ca.crt
    ca-bundle.crt
    sub.class1.server.ca.crt
    sub.class2.server.ca.crt
    sub.class3.server.ca.crt
    sub.class4.server.ca.crt

    and put all certificates into /root/ispconfig/httpd/conf/ssl.crt (the default ca-bundle.crt from ISPconfig renamed to ca-bundle.crt.ispconf)

    I edited httpd.conf in /root/ispconfig/httpd/conf :

    Code:
    SSLCertificateFile /root/ispconfig/httpd/conf/ssl.crt/ssl.crt
    SSLCertificateKeyFile /root/ispconfig/httpd/conf/ssl.key/server.key
    SSLCertificateChainFile /root/ispconfig/httpd/conf/ssl.crt/sub.class2.server.ca.crt
    SSLCACertificateFile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt 
    I restarted server

    All the same - browser deemed my certificate unsecure (not recognized authority).

    I changed SSLCertificateChainFile and SSLCACertificateFile to all possible combinations, each time restarted server and cleared cache in browser. No joy.

    When I do:
    Code:
    openssl verify -CAfile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt -purpose sslserver /root/ispconfig/httpd/conf/ssl.crt/ssl.crt
    the result is OK but then I can't access admin area on port 81 (websites and emails works) = that is second problem I need help with, I have one live server I cant access admin area now :( This is working now. I had typo in httpd/conf/httpd.conf. :eek: I am able to access admin on this site after fixing typo and restarting ISPConfig. :D

    What I am duing wrong? Where else I have to edit something? :confused:

    More info: obviously I use https connection to admin area on port 81
    the certificate is specific to the servers admin area - not valid for other domains (server2.mydomain.net)
    systems are Debian Lenny (1x) and Debian Etch (1x)

    Thanks very much for help.


    Update
    The certificate on the server which had typo is now working. I am going trough the other's conf file to make sure there is not a typo as well.
    I am reinstalling ISPConfig on the second server once more and after I'll try to install certificate again. Will see what will happened.
     
    Last edited: Apr 7, 2009
  2. lubos

    lubos New Member

    Certificates are working. It was probably some other typo. If you need to install StartSSL.com certificate into admin area use this setup:

    Class 2 certificate from startssl.com named ssl.crt
    Download their certificates:
    ca.crt
    ca-bundle.crt
    sub.class1.server.ca.crt
    sub.class2.server.ca.crt
    sub.class3.server.ca.crt
    sub.class4.server.ca.crt

    and put all certificates into /root/ispconfig/httpd/conf/ssl.crt (the default ca-bundle.crt from ISPconfig renamed to ca-bundle.crt.ispconf)

    Edit httpd.conf in /root/ispconfig/httpd/conf :


    Code:
    SSLCertificateFile /root/ispconfig/httpd/conf/ssl.crt/ssl.crt
    SSLCertificateKeyFile /root/ispconfig/httpd/conf/ssl.key/server.key
    SSLCertificateChainFile /root/ispconfig/httpd/conf/ssl.crt/sub.class2.server.ca.crt
    SSLCACertificateFile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt 
    Restart server.
     
    Last edited: Apr 7, 2009
  3. danuel

    danuel New Member

    StartSSL.com for Vhosts

    I have a similar issue installing the CA certificates for StartSSL.com for Vhosts. It installs once /etc/apache2/vhosts/Vhosts_ispconfig.conf is edited and following code added

    Code:
    # existing lines
    SSLEngine on
    SSLCertificateFile /var/www/some.site.com/ssl/site.crt
    SSLCertificateKeyFile /var/www/some.site.com/ssl/site.key
    
    #add these lines for Certificate Authority 
    SSLCertificateChainFile var/www/some.site.com/ssl/sub.class1.server.ca.pem
    SSLCACertificateFile var/www/some.site.com/ssl/ca.pem
    
    
    Please ensure you replace some.site.com with the actual site name (folder path must exists).

    See http://www.startssl.com/?app=21.
    Make sure you download sub.class1.server.ca.pem and ca.pem from http://www.startssl.com/certs/. Store them in var/www/some.site.com/ssl/

    Unfortunately, as soon you make any changes in ISPConfig web interface, the file /etc/apache2/vhosts/Vhosts_ispconfig.conf is overwritten. Falko, is there a way to fix this please? If you need help with modifying the php function that writes the Vhosts config file, maybe I can help. But a better fix would be to also re-work the SSL tab in ISPConfig so there is space for Certificate Authority Chain file and Certificate file.
     
    Last edited: May 13, 2009
  4. danuel

    danuel New Member

    SSLCACertificatePath

    See http://www.howtoforge.com/forums/showthread.php?t=14569&page=3

    Since /etc/apache2/vhosts/Vhosts_ispconfig.conf is dynamically generated by ISPC from info in db, it is suggested to add SSLCACertificateFile and SSLCertificateChainFile directives in /etc/apache2/apache2.conf or httpd.conf . This is not an ideal solution since it's not in the Virtual host directives because different vhosts may need different CA certificates.

    After reading http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslcacertificatepath, best solution may be to use SSLCACertificatePath directive instead of either/both SSLCACertificateFile and SSLCertificateChainFile. We can add the following to /etc/apache2/apache2.conf file (last line after include Vhosts is ok)
    Code:
    Include /etc/apache2/vhosts/Vhosts_ispconfig.conf
    SSLCACertificatePath /var/www/ssl_ca
    
    In /var/www/ssl_ca we'll keep all the CA certificates from any/all trusted Certificate Authorities (client/site certificates under their respective directories handled by ISPConfig db). Make sure you only use "pem" encoded certificates.

    From startssl.com, you only need following:
    Code:
    ca.pem
    sub.class1.server.ca.pem
    sub.class2.server.ca.pem
    sub.class3.server.ca.pem
    sub.class4.server.ca.pem
    
    Unlike mentioned above, you don't need ca-bundle, which includes a lot of other unneeded certs and file size is over 90Kb. All the files above add up to less than 20Kb.

    Every time you add/remove files to /var/www/ssl_ca, please remember to run:
    Code:
    c_rehash /var/www/ssl_ca
    

    Hopefully, future ISPC releases can include a automatically run script to dynamically obtain (wget) the CA certs (all available online) from major/all browser trusted certificate authorities to keep the folder current -- this folder can be anywhere ISPConfig maintains dynamically maintained files (like Vhosts config files). All that will be needed then is just the site server key (private) and site server crt (public) manages by ISPConfig web interface.
     
    Last edited: May 13, 2009
  5. till

    till Super Moderator Howtoforge Staff HowtoForge Supporter ISPConfig Developer

    You can simply add the lines:

    SSLCertificateChainFile var/www/some.site.com/ssl/sub.class1.server.ca.pem
    SSLCACertificateFile var/www/some.site.com/ssl/ca.pem

    in the apache directives field of the website settings in ispconfig.
     

Share This Page