Securing Your ISPConfig 3 Installation With A Free Class1 SSL Certificate From StartSSL - Page 2

4 ISPConfig Interface (Apache2)

If you use ISPConfig 3 with Apache, open /etc/apache2/sites-available/ispconfig.vhost...

vi /etc/apache2/sites-available/ispconfig.vhost

... and add the line SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/ to the # SSL Configuration section (please be aware that you have to re-add that line whenever you update ISPConfig!):

  # SSL Configuration
  SSLEngine On
  SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
  SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
  ## must be re-added after an ISPConfig update!!!
  SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/

(Adjust this if you use a Class2 certificate.)

Restart Apache afterwards:

/etc/init.d/apache2 restart


5 ISPConfig Interface (nginx)

On nginx, all you have to do is append the intermediate certificate to the ispserver.crt file (please adjust this if you use a Class2 certificate)...

cat /usr/local/ispconfig/interface/ssl/ >> /usr/local/ispconfig/interface/ssl/ispserver.crt

... and reload nginx:

/etc/init.d/nginx reload


6 Postfix

For Postfix, we make backups of /etc/postfix/smtpd.cert and /etc/postfix/smtpd.key and create symlinks to /usr/local/ispconfig/interface/ssl/ispserver.crt and /usr/local/ispconfig/interface/ssl/ispserver.key:

cd /etc/postfix
mv smtpd.cert smtpd.cert_bak
mv smtpd.key smtpd.key_bak
ln -s /usr/local/ispconfig/interface/ssl/ispserver.crt smtpd.cert
ln -s /usr/local/ispconfig/interface/ssl/ispserver.key smtpd.key

Next we add the smtpd_tls_CAfile directive to /etc/postfix/

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt'

(Please adjust this if you use a Class2 certificate.)

... and restart Postfix:

/etc/init.d/postfix restart


7 Dovecot

Open /etc/dovecot/dovecot.conf...

vi /etc/dovecot/dovecot.conf

... and add the line ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt (please be aware that you have to re-add that line whenever you update ISPConfig!):

ssl_cert_file = /etc/postfix/smtpd.cert
ssl_key_file = /etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt

(Adjust this if you use a Class2 certificate.)

Restart Dovecot afterwards:

/etc/init.d/dovecot restart


8 Courier

Create backups of /etc/courier/imapd.pem and /etc/courier/pop3d.pem...

mv /etc/courier/imapd.pem /etc/courier/imapd.pem.bak
mv /etc/courier/pop3d.pem /etc/courier/pop3d.pem.bak

... and then symlink them to /usr/local/ispconfig/interface/ssl/ispserver.pem:

ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem /etc/courier/imapd.pem
ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem /etc/courier/pop3d.pem

Restart Courier afterwards:

/etc/init.d/courier-imap-ssl stop
/etc/init.d/courier-imap-ssl start
/etc/init.d/courier-pop-ssl stop
/etc/init.d/courier-pop-ssl start


9 PureFTPd

Create a backup of /etc/ssl/private/pure-ftpd.pem...

cd /etc/ssl/private/
mv pure-ftpd.pem pure-ftpd.pem_bak

... and create a symlink to /usr/local/ispconfig/interface/ssl/ispserver.pem:

ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem pure-ftpd.pem

Restart PureFTPd afterwards:

/etc/init.d/pure-ftpd-mysql restart


10 Monit

Monit is not part of the "Perfect Server" setups for ISPConfig 3, but if you have it installed and use its web interface over https, here's how you can use the StartSSL certificate so that the certificate warnings go away.

Open /etc/monit/monitrc...

vi /etc/monit/monitrc

... and specify /usr/local/ispconfig/interface/ssl/ispserver.pem in the PEMFILE line, e.g. as follows:

set httpd port 2812 and
     PEMFILE /usr/local/ispconfig/interface/ssl/ispserver.pem
     allow admin:secret

Restart monit afterwards:

/etc/init.d/monit restart


11 Links


About The Author

Falko Timme is the owner of Boost Your Site mit Timme Hosting - ultra-schnelles nginx-WebhostingTimme Hosting (ultra-fast nginx web hosting). He is the lead maintainer of HowtoForge (since 2005) and one of the core developers of ISPConfig (since 2000). He has also contributed to the O'Reilly book "Linux System Administration".

Share this page:

19 Comment(s)

Add comment


From: daharasam at: 2012-01-18 10:13:02

Well it is an useful tutor....and will helpful for many others.

From: MaddinXx at: 2012-01-18 19:22:00

Just great!

Thank you so much for this, was one of these points I just was not able to look through until now.

I am just wondering if you don't have to CHMOD 750 the ispserver.crt file?


From: benjamin at: 2012-01-23 10:24:16

Well, this tutor was quite useful  and very informative too........

From: Anonymous at: 2012-01-23 04:10:35

Thanks For The useful Information. It Would Help A Lot.

From: Anonymous at: 2013-03-22 20:10:59

Really should state that the "Free" cert is really a 30 day cert in exchange for your personal info.

From: Anonymous at: 2013-09-12 17:44:34

Doesnt really work any more.   The last 2 servers I tried this on was declined with this response: 

 Thank you for requesting a digital certificate with us. However Class 1 certificates are not meant to be used for commercial activities or financial transactions. For this purpose please consider upgrading to Class 2 or higher verification level. Thank you for your understanding.

The only 2 things on these servers was a fresh install of ISPConfig3.  

From: at: 2012-01-26 09:51:07

While installing the certificate into postfix the line

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt'

 should read

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/'

 otherwise postfix will complain about the missing file and automatically disable TLS.

 Otherwise great post, very helpful!

From: at: 2012-01-31 14:37:49

I corrected this msitake and still postfix is complaining about TLS probs :-( 

anything else wrong with this tutorial?



From: geonick at: 2012-04-04 11:03:17

I haven't tried using the postfix part of the guide yet but in the directory /usr/local/ispconfig/interface/ssl/ there seem to be both startssl.chain.class1.server.crt as well as Any arguments on why postconf will complain about missing files?  It's been a while since the post and the guide has not been updated... Is there or is there not a mistake with the crt file?

From: Anonymous at: 2012-07-10 12:00:55

has any one had this working on cent0s 6.2
i have tried 3 times and cant get it to work

vi /etc/apache2/sites-available/ispconfig.vhost - says it ius a new directory are there any directions for this?

From: Anonymous at: 2012-10-13 16:45:29

great tutorial


for centos 


From: at: 2012-11-25 21:57:01

I installed all ISPConfig thanks to this site and the answers of Falko and Till Brehm.

Yours, the new hosting guy, 


From: Ninja at: 2012-12-15 03:30:39

I installed per instructions and it seemed to be working, but I received an email from startssl that I needed to install  the intermediate CA certificate.  This appeared to be confirmed by checking my site in

I changed the  /etc/apache2/sites-available/ispconfig.vhost addition to:

SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt

and it seem to work and checked out in digicert.


From: at: 2013-04-07 15:27:43

Falko, You saved me a lot of time with this tutorial, and I'm sure a lot of others too... Outstanding tutorial!  Thank you!  Darin



From: Leonel Hernández at: 2013-05-17 22:16:55

hy Falko i want thanks you very much because i have done many of your tutorials and i have be out of mistakes :) THANKS ALOT brother keep working :) take CARE

From: Sascha at: 2013-05-21 10:25:29

Hi Falko,

as always...great job! Thank you very much.
Everything is working, except with monit. Here's the error on restart of the service:

Starting daemon monitor: Syntax error:
monit: The SSL server PEM file '/usr/local/ispconfig/interface/ssl/ispserver.pem' must be owned by you.
/etc/monit/monitrc:8: Error: SSL server PEM file has too loose permissions '/usr/local/ispconfig/interface/ssl/ispserver.pem'

 In fact, the file is owned by "ispconfig" rather than "root", which i presume munin expects.

What can i do?
Thank you very much


From: monnoliv at: 2013-07-24 19:48:37

 Congratulation Falko, first time right!

Send me your photo, I'll create a bust in your effigy and I'll place it next to my PC :-)

 Thanks a lot,


From: Carlos Utrera at: 2013-09-13 17:31:34

Althought cert are working for postfix, courier, ... seems not work in apache. I have tested my site and has an default cert. What could be the problem? Centos 6.2 + Apache+Postfix+Courier+Ispconfig3.

I also have to mention that httpd get me this error when i restart:

Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using for ServerName

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:443 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[  OK  ]

You could test here: if you find for you get a cert thaht seems to be first created in ispconfig.


From: at: 2013-11-26 18:20:36


ssl_cert = </etc/postfix/smtpd.cert
ssl_key = </etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca = </usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt


ssl_cert_file = /etc/postfix/smtpd.cert
ssl_key_file = /etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt