SSL Setup Question

Discussion in 'Installation/Configuration' started by bschultz, May 27, 2007.

  1. bschultz

    bschultz Member

    Hi,

    I've purchased an SSL Cert from Godaddy, created the key and csr files, and downloaded my cert. All that is fine. Now, I don't know what to do next. What needs to be done in the ISPC admin panel to setup the new cert on an existing site? Where does the cert need to be placed on the server?

    Thanks.

    Brian
     
  2. till

    till Super Moderator

    Copy and paste the certificate to the certificate field in ISPConfig of this website, select save as action and the click on the save button
     
  3. falko

    falko Super Moderator

  4. bschultz

    bschultz Member

    Thanks for the help, guys. The site shows a generic error page in IE. In Firefox, I get an error code 12263 SSL_ERROR_RX_RECORD_TOO_LONG message.

    Any ideas?
     
  5. falko

    falko Super Moderator

    Any errors in the Apache logs?
     
  6. bschultz

    bschultz Member

    The only thing in the (Apache2) error log was this...

    [Mon May 28 14:47:08 2007] [notice] Apache/2.2.3 (Debian) PHP/5.2.0-8+etch4 mod_ssl/2.2.3 OpenSSL/0.9.8c configured -- resuming normal operations

    And that wasn't even when I tried to access the site in question. There are several of those same messages in the error log.

    There were no errors in the /var/log/httpd/ logs.

    One other thing...should the Vhosts file for this domain have any SSL comments in it...or does that go someplace else? This is the Vhosts section of this domain:

     
    Last edited: May 29, 2007
  7. bschultz

    bschultz Member

    I did some further testing (and Googling) and I manually added a separate Vhosts entry for the site at port 443

    I restarted Apache, entered the pass phrase and Apache restarted without errors. I then logged on the https site, and got to the https directory...but, I encountered a certificate error.

    This error shows up in Firefox and Safri on a Mac...but not in IE. So, I have three questions:

    1-Why the error in Firefox (PC) and Safari (Mac) and not IE (PC)?
    2-Will the Vhosts config "stay" after an ISPConfig upgrade
    3-Is there any way to not have to enter the pass phrase on reboot of Apache?

    Thanks for all the help!

    Brian
     
    Last edited: May 29, 2007
  8. falko

    falko Super Moderator

    When you enable SSL on the Basis tab of the web site in ISPConfig, there should be a second vhost that contains the SSL settings. If you don't see that second vhost: can you post the
    Code:
    ls -l
    output of the directory where Vhosts_ispconfig.conf is in?
    What's the output of
    Code:
    ls -la /root/ispconfig
    ?
     
  9. bschultz

    bschultz Member

    Thanks Falko...here they are:


     
  10. falko

    falko Super Moderator

    Ok, can you rename one of those Vhosts_ispconfig.conf files that have a date at the end to Vhosts_ispconfig.conf and run
    Code:
    httpd -t
    ? What's the output?
     
  11. bschultz

    bschultz Member

    Thanks again for the help on this. No matter which config file I renamed, I get the following error:

    Here's the content of the file (for the domain in question):

     
  12. bschultz

    bschultz Member

    I deleted the website in the ISP CP, and then tried to re-create the site...then I looked in the vhosts.ispconf file, and there still isn't an SSL section for this site.
     
  13. daveb

    daveb Member

    I had this issue also. To resolve this I had to download gd_intermediate_bundle.cer from Godaddy.com/Repository
    then upload to my sites ssl folder. Then from the ispconfig control panel for that site in apache directives I had to add the line "SSLCACertificateFile /var/www/web?/ssl/gd_intermediate_bundle.cer" and Save.
    after that I no longer had any Problems with errors in firefox.
     
  14. bschultz

    bschultz Member

    Thanks, Dave. I was wondering what I was supposed to do with that file. it said to download it...just not what to do with it. Now, I just need to figure out why ISPConfig isn't adding the SSL site in the vhosts file.

    Thanks again Dave and Falko!
     
  15. till

    till Super Moderator

    Please do what falko posted in #10 in this thread. ISPConfig is not writing your config file because it contains errors that would prevent the startup of apache, so the new config file is written with a date appended to the filname. To find the error, you must rename it to Vhost_ispconfig.conf and run the command: httpd -t
     
  16. bschultz

    bschultz Member

    I did...post #11.
     
  17. falko

    falko Super Moderator

    You have a virtual host within a virtual host:

    Code:
    <VirtualHost 192.168.1.4:443>
    ServerName http://domain.com
    SSLEngine on
    SSLCertificateFile \
    /certificates/domain.com.crt
    SSLCertificateKeyFile \
    /certificates/domain.com.key
    </VirtualHost>
    Did you put it there? Something like this isn't written by ISPConfig.
     
  18. bschultz

    bschultz Member

    That was put in by me. Upon installing the certificate based on your directions on the first page of this thread, I looked in the vhosts file and didn't see any SSL section. So I tried to add it in the Apache Directives for this domain. I didn't realize that it would add the virtual host inside the other virtual host...so obviously it didn't like the syntax...and named the file by the date. Then in post #10 you wanted me to rename one of those files and remove the date. That's where we are now. The problem is that ISPConfig isn't adding the separate vhost for the ssl port...just the regular stuff on port 80. Thanks again for all the help on this!!!
     
  19. daveb

    daveb Member

    bschultz, just speaking from my own experience here. not sure if it would help. but have you created a ssl crt from the ispconfig control panel for that web. I had this issue when I had a ssl cert already and just checked off ssl in the control panel and thought groovy but nothing ever was wrote to the vhost file. wasnt till I created a csr or self signed ssl via the control panel that it added the appropriate lines withen the vhost file.
     
  20. bschultz

    bschultz Member

    Dave,

    That worked to get the Apache vhost info correct....but I'm still getting a cert error....even after your suggestion of

    in the Apache directive field.
     

Share This Page