Securing Your ISPConfig 3 Installation With A Free Class1 SSL Certificate From StartSSL

Version 1.0
Author: Falko Timme
Follow me on Twitter
Last edited 01/16/2012

This tutorial shows how you can use a free Class1 SSL Certificate from StartSSL to secure your ISPConfig 3 installation and get rid of self-signed certificate warnings. The guide covers using the SSL certificate for the ISPConfig web interface (both Apache2 and nginx), Postfix (for TLS connections), Courier and Dovecot (for POP3s and IMAPs), and PureFTPd (for TLS/FTPES connections). If you've installed monit and use HTTPS for its web interface, I will show you how to use the StartSSL certificate for it as well. This guide assumes you use Debian or Ubuntu; the principle is the same for other distributions supported by ISPConfig 3, but paths might differ.

I do not issue any guarantee that this will work for you!

 

1 Preliminary Note

I assume you have used one of the guides from http://www.ispconfig.org/ispconfig-3/documentation/ to set up your system. As I've mentioned before, I will concentrate on Debian/Ubuntu in this guide, but it should work for other distributions supported by ISPconfig 3 as well (you might have to adjust some paths though).

I will use the hostname server1.example.com here; StartSSL allows you to create the Class1 certificate for the main domain and one subdomain, so I will create the certificate for example.com and server1.example.com. This means that you must tell your users to use the main domain example.com or the subdomain server1.example.com for all services (ISPConfig web interface, Postfix, Courier/Dovecot, PureFTPD, etc.) because otherwise they will get certificate warnings.

If you prefer to use different hostnames for your services (e.g. mail.example.com for Postfix, ispconfig.example.com for ISPConfig, etc.), I suggest you get a Class2 certificate from StartSSL. It isn't free, but allows you to create it for multiple subdomains (you can even use *.example.com to create it for all subdomains) and even multiple domains. The instructions are the same, except that when I use StartSSL's sub.class1.server.ca.pem intermediate certificate, you must use sub.class2.server.ca.pem instead. I will outline this difference throughout the tutorial.

I'm running all the steps in this tutorial with root privileges, so make sure you're logged in as root. If you use Ubuntu, run...

sudo su

... to get root privileges.

 

2 Creating A Certificate Signing Request (CSR)

We need a Certificate Signing Request (CSR) to get an SSL certificate from StartSSL. Since the ISPConfig installer (for versions >= 3.0.4) creates this anyway, I will use this CSR as the basis for encrypting all services (ISPConfig, Postfix, etc.).

Since ISPConfig version 3.0.4, the ISPConfig installer offers the option to use SSL encryption for the ISPConfig web interface, it creates a self-signed certificate (4096bits) including a CSR if you answer the following question with ENTER or y:

Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <-- ENTER

To make the ISPConfig installer create the CSR with the correct data, you must enter the correct details when you see these questions:

Generating RSA private key, 4096 bit long modulus
............................................................++
.....................................................................++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
<-- DE
State or Province Name (full name) [Some-State]: <-- Niedersachsen
Locality Name (eg, city) []: <-- Lueneburg
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- My Company Ltd.
Organizational Unit Name (eg, section) []: <-- IT
Common Name (eg, YOUR name) []: <-- example.com
Email Address []: <-- hostmaster@example.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
<-- ENTER
An optional company name []: <-- ENTER
writing RSA key

If you have initially created the certificate with the wrong data, you can either update ISPConfig by running...

ispconfig_update.sh

..., or, if you have the latest version installed already, run the following commands:

cd /tmp
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
tar xvfz ISPConfig-3-stable.tar.gz
cd ispconfig3_install/install
php -q update.php

This will allow you to create a new certificate for your ISPConfig 3 web interface by answering the following question with yes:

Create new ISPConfig SSL certificate (yes,no) [no]: <-- yes

If you use an ISPConfig version prior to 3.0.4, you should now upgrade to the latest stable version by running...

ispconfig_update.sh

This will also allow you to create an SSL connection for your ISPConfig 3 web interface by answering the following question with yes:

Create new ISPConfig SSL certificate (yes,no) [no]: <-- yes

As outlined above, make sure you enter the correct details.

Afterwards, you should have an SSL key, a CSR, and a self-signed certificate in the /usr/local/ispconfig/interface/ssl/ directory:

ls -l /usr/local/ispconfig/interface/ssl/

root@server1:~# ls -l /usr/local/ispconfig/interface/ssl/
total 16
-rwxr-x--- 1 ispconfig ispconfig 2423 Jan 16 13:29 ispserver.crt
-rwxr-x--- 1 ispconfig ispconfig 1777 Jan 16 13:29 ispserver.csr
-rwxr-x--- 1 ispconfig ispconfig 3243 Jan 16 13:29 ispserver.key
-rwxr-x--- 1 ispconfig ispconfig 3311 Jan 16 13:28 ispserver.key.secure
root@server1:~#

All we need in this tutorial is the private key (ispserver.key) and the CSR (ispserver.csr); we will replace ispserver.crt with the Class1 certificate from StartSSL. You can ignore ispserver.key.secure.

It is also possible to create ispserver.key and ispserver.csr on the command line as follows:

cd /usr/local/ispconfig/interface/ssl/
openssl req -new -newkey rsa:4096 -days 365 -nodes -keyout ispserver.key -out ispserver.csr

(This will give you no ispserver.crt which doesn't matter as we will get our signed certificate from StartSSL.)

Your ispserver.csr should be similar to this one (I've x'ed out big parts of it because this is a real CSR I use):

cat /usr/local/ispconfig/interface/ssl/ispserver.csr

-----BEGIN CERTIFICATE REQUEST-----
MIIC7TCCAdUCAQAwgacxCzAJBgxxxxxxAkRFMRYwFAYDVQQIDA1OaWVkZXJzYWNo
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
9Z5RhXTfOz8F2wsNH5yP9eqkVlkYKpIwyUHoZtUSp+xz
-----END CERTIFICATE REQUEST-----

 

3 Getting Your Free Class1 Certificate From StartSSL

Now go to http://www.startssl.com/ and create an account. After you have validated your domain (on the Validations Wizard tab), you can request your certificate on the Certificates Wizard tab - select Web Server SSL/TLS Certificate from the Certificate Target drop-down field:

Since we already have a private key and a CSR, we can skip the next step - click on Skip >>:

On the next page, you fill in your CSR, i.e., the contents of the /usr/local/ispconfig/interface/ssl/ispserver.csr file (beginning with -----BEGIN CERTIFICATE REQUEST----- and ending with -----END CERTIFICATE REQUEST-----):

Then follow the rest of the wizard - it will ask you for a domain and one subdomain for which the certificate will be created. If you use server1.example.com for all your services, fill in example.com as the domain and server1 as the subdomain.

After a few minutes, you will receive an email that your new certificate is ready. Go to Toolbox > Retrieve Certificate and select your certificate:

Copy the certificate from StartSSL's web interface...

... and make a backup of your original ispserver.crt file and paste the StartSSL Class1 certificate into the (empty) ispserver.crt file:

mv /usr/local/ispconfig/interface/ssl/ispserver.crt /usr/local/ispconfig/interface/ssl/ispserver.crt_bak
vi /usr/local/ispconfig/interface/ssl/ispserver.crt

-----BEGIN CERTIFICATE-----
MIIHMTCCBhmgAwIBAgIDxxxxxx0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
c2x1wonVRVmKovt2OuM1ZqZw0Ynk
-----END CERTIFICATE-----

Next download StartSSL's Root CA and the Class1 Intermediate Server CA:

cd /usr/local/ispconfig/interface/ssl
wget https://www.startssl.com/certs/ca.pem
wget https://www.startssl.com/certs/sub.class1.server.ca.pem

(If you use a Class2 certificate, please download sub.class2.server.ca.pem instead of sub.class1.server.ca.pem).

Rename both files:

mv ca.pem startssl.ca.crt
mv sub.class1.server.ca.pem startssl.sub.class1.server.ca.crt

(Adjust the second command if you use a Class2 certificate.)

Some services require a .pem file which we create as follows (again, make sure you adjust the commands if you use a Class2 certificate):

cat startssl.sub.class1.server.ca.crt startssl.ca.crt > startssl.chain.class1.server.crt
cat ispserver.{key,crt} startssl.chain.class1.server.crt > ispserver.pem
chmod 600 ispserver.pem

Share this page:

19 Comment(s)

Add comment

Comments

From: daharasam at: 2012-01-18 10:13:02

Well it is an useful tutor....and will helpful for many others.

From: MaddinXx at: 2012-01-18 19:22:00

Just great!

Thank you so much for this, was one of these points I just was not able to look through until now.

I am just wondering if you don't have to CHMOD 750 the ispserver.crt file?

 

From: benjamin at: 2012-01-23 10:24:16

Well, this tutor was quite useful  and very informative too........

From: Anonymous at: 2012-01-23 04:10:35

Thanks For The useful Information. It Would Help A Lot.

From: Anonymous at: 2013-03-22 20:10:59

Really should state that the "Free" cert is really a 30 day cert in exchange for your personal info.

From: Anonymous at: 2013-09-12 17:44:34

Doesnt really work any more.   The last 2 servers I tried this on was declined with this response: 

 Thank you for requesting a digital certificate with us. However Class 1 certificates are not meant to be used for commercial activities or financial transactions. For this purpose please consider upgrading to Class 2 or higher verification level. Thank you for your understanding.

The only 2 things on these servers was a fresh install of ISPConfig3.  

From: at: 2012-01-26 09:51:07

While installing the certificate into postfix the line

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt'

 should read

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt'

 otherwise postfix will complain about the missing file and automatically disable TLS.

 Otherwise great post, very helpful!

From: at: 2012-01-31 14:37:49

I corrected this msitake and still postfix is complaining about TLS probs :-( 

anything else wrong with this tutorial?

 help!

 

From: geonick at: 2012-04-04 11:03:17

I haven't tried using the postfix part of the guide yet but in the directory /usr/local/ispconfig/interface/ssl/ there seem to be both startssl.chain.class1.server.crt as well as startssl.sub.class1.server.ca.crt. Any arguments on why postconf will complain about missing files?  It's been a while since the post and the guide has not been updated... Is there or is there not a mistake with the crt file?

From: Anonymous at: 2012-07-10 12:00:55

has any one had this working on cent0s 6.2
i have tried 3 times and cant get it to work

vi /etc/apache2/sites-available/ispconfig.vhost - says it ius a new directory are there any directions for this?

From: Anonymous at: 2012-10-13 16:45:29

great tutorial

 

for centos 

/etc/httpd/conf/sites-available/ispconfig.vhost
 

From: at: 2012-11-25 21:57:01

I installed all ISPConfig thanks to this site and the answers of Falko and Till Brehm.

Yours, the new hosting guy, 

thanks. 

From: Ninja at: 2012-12-15 03:30:39

I installed per instructions and it seemed to be working, but I received an email from startssl that I needed to install  the intermediate CA certificate.  This appeared to be confirmed by checking my site in http://www.digicert.com/help/

I changed the  /etc/apache2/sites-available/ispconfig.vhost addition to:

SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt

and it seem to work and checked out in digicert.

 

From: at: 2013-04-07 15:27:43

Falko, You saved me a lot of time with this tutorial, and I'm sure a lot of others too... Outstanding tutorial!  Thank you!  Darin


 

 

From: Leonel Hernández at: 2013-05-17 22:16:55

hy Falko i want thanks you very much because i have done many of your tutorials and i have be out of mistakes :) THANKS ALOT brother keep working :) take CARE

From: Sascha at: 2013-05-21 10:25:29

Hi Falko,

as always...great job! Thank you very much.
Everything is working, except with monit. Here's the error on restart of the service:

Starting daemon monitor: Syntax error:
monit: The SSL server PEM file '/usr/local/ispconfig/interface/ssl/ispserver.pem' must be owned by you.
/etc/monit/monitrc:8: Error: SSL server PEM file has too loose permissions '/usr/local/ispconfig/interface/ssl/ispserver.pem'

 In fact, the file is owned by "ispconfig" rather than "root", which i presume munin expects.

What can i do?
Thank you very much

Sascha

From: monnoliv at: 2013-07-24 19:48:37

 Congratulation Falko, first time right!

Send me your photo, I'll create a bust in your effigy and I'll place it next to my PC :-)

 Thanks a lot,

 Olivier

From: Carlos Utrera at: 2013-09-13 17:31:34

Althought cert are working for postfix, courier, ... seems not work in apache. I have tested my site server.todo-host.com and has an default cert. What could be the problem? Centos 6.2 + Apache+Postfix+Courier+Ispconfig3.

I also have to mention that httpd get me this error when i restart:

Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using server.todo-host.com for ServerName

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost 80.82.222.129:443 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:443 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[  OK  ]

You could test here: https://sslcheck.globalsign.com/es/sslcheck if you find for server.todo-host.com you get a cert thaht seems to be first created in ispconfig.

 

From: at: 2013-11-26 18:20:36


CORRECT WORKING CONFIG FORMAT

[...]
ssl_cert = </etc/postfix/smtpd.cert
ssl_key = </etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca = </usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]

 
 
INCORRECT OBSOLETE CONFIG FORMAT

[...]
ssl_cert_file = /etc/postfix/smtpd.cert
ssl_key_file = /etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]