Securing Your ISPConfig 3 Installation With A Free Class1 SSL Certificate From StartSSL - Page 2

4 ISPConfig Interface (Apache2)

If you use ISPConfig 3 with Apache, open /etc/apache2/sites-available/ispconfig.vhost...

vi /etc/apache2/sites-available/ispconfig.vhost

... and add the line SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt to the # SSL Configuration section (please be aware that you have to re-add that line whenever you update ISPConfig!):

[...]
  # SSL Configuration
  SSLEngine On
  SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
  SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
  ## must be re-added after an ISPConfig update!!!
  SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt
[...]

(Adjust this if you use a Class2 certificate.)

Restart Apache afterwards:

/etc/init.d/apache2 restart

 

5 ISPConfig Interface (nginx)

On nginx, all you have to do is append the intermediate certificate to the ispserver.crt file (please adjust this if you use a Class2 certificate)...

cat /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt >> /usr/local/ispconfig/interface/ssl/ispserver.crt

... and reload nginx:

/etc/init.d/nginx reload

 

6 Postfix

For Postfix, we make backups of /etc/postfix/smtpd.cert and /etc/postfix/smtpd.key and create symlinks to /usr/local/ispconfig/interface/ssl/ispserver.crt and /usr/local/ispconfig/interface/ssl/ispserver.key:

cd /etc/postfix
mv smtpd.cert smtpd.cert_bak
mv smtpd.key smtpd.key_bak
ln -s /usr/local/ispconfig/interface/ssl/ispserver.crt smtpd.cert
ln -s /usr/local/ispconfig/interface/ssl/ispserver.key smtpd.key

Next we add the smtpd_tls_CAfile directive to /etc/postfix/main.cf...

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt'

(Please adjust this if you use a Class2 certificate.)

... and restart Postfix:

/etc/init.d/postfix restart

 

7 Dovecot

Open /etc/dovecot/dovecot.conf...

vi /etc/dovecot/dovecot.conf

For Dovecot 1.x:

... and add the line ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt (please be aware that you have to re-add that line whenever you update ISPConfig!):

[...]
ssl_cert_file = /etc/postfix/smtpd.cert
ssl_key_file = /etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]

(Adjust this if you use a Class2 certificate.)

For Dovecot 2.x:

... and add the line ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt (please be aware that you have to re-add that line whenever you update ISPConfig!):

[...]
ssl_cert = </etc/postfix/smtpd.cert
ssl_key = </etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca = </usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]

(Adjust this if you use a Class2 certificate.)

Restart Dovecot afterwards:

/etc/init.d/dovecot restart

 

8 Courier

Create backups of /etc/courier/imapd.pem and /etc/courier/pop3d.pem...

mv /etc/courier/imapd.pem /etc/courier/imapd.pem.bak
mv /etc/courier/pop3d.pem /etc/courier/pop3d.pem.bak

... and then symlink them to /usr/local/ispconfig/interface/ssl/ispserver.pem:

ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem /etc/courier/imapd.pem
ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem /etc/courier/pop3d.pem

Restart Courier afterwards:

/etc/init.d/courier-imap-ssl stop
/etc/init.d/courier-imap-ssl start
/etc/init.d/courier-pop-ssl stop
/etc/init.d/courier-pop-ssl start

 

9 PureFTPd

Create a backup of /etc/ssl/private/pure-ftpd.pem...

cd /etc/ssl/private/
mv pure-ftpd.pem pure-ftpd.pem_bak

... and create a symlink to /usr/local/ispconfig/interface/ssl/ispserver.pem:

ln -s /usr/local/ispconfig/interface/ssl/ispserver.pem pure-ftpd.pem

Restart PureFTPd afterwards:

/etc/init.d/pure-ftpd-mysql restart

 

10 Monit

Monit is not part of the "Perfect Server" setups for ISPConfig 3, but if you have it installed and use its web interface over https, here's how you can use the StartSSL certificate so that the certificate warnings go away.

Open /etc/monit/monitrc...

vi /etc/monit/monitrc

... and specify /usr/local/ispconfig/interface/ssl/ispserver.pem in the PEMFILE line, e.g. as follows:

[...]
set httpd port 2812 and
     SSL ENABLE
     PEMFILE /usr/local/ispconfig/interface/ssl/ispserver.pem
     allow admin:secret
[...]

Restart monit afterwards:

/etc/init.d/monit restart

 

11 Links

 

About The Author

Falko Timme is the owner of Boost Your Site mit Timme Hosting - ultra-schnelles nginx-WebhostingTimme Hosting (ultra-fast nginx web hosting). He is the lead maintainer of HowtoForge (since 2005) and one of the core developers of ISPConfig (since 2000). He has also contributed to the O'Reilly book "Linux System Administration".

Share this page:

15 Comment(s)

Add comment

Comments

From: at: 2012-01-26 09:51:07

While installing the certificate into postfix the line

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt'

 should read

postconf -e 'smtpd_tls_CAfile = /usr/local/ispconfig/interface/ssl/startssl.sub.class1.server.ca.crt'

 otherwise postfix will complain about the missing file and automatically disable TLS.

 Otherwise great post, very helpful!

From: at: 2012-01-31 14:37:49

I corrected this msitake and still postfix is complaining about TLS probs :-( 

anything else wrong with this tutorial?

 help!

 

From: geonick at: 2012-04-04 11:03:17

I haven't tried using the postfix part of the guide yet but in the directory /usr/local/ispconfig/interface/ssl/ there seem to be both startssl.chain.class1.server.crt as well as startssl.sub.class1.server.ca.crt. Any arguments on why postconf will complain about missing files?  It's been a while since the post and the guide has not been updated... Is there or is there not a mistake with the crt file?

From: Anonymous at: 2012-07-10 12:00:55

has any one had this working on cent0s 6.2
i have tried 3 times and cant get it to work

vi /etc/apache2/sites-available/ispconfig.vhost - says it ius a new directory are there any directions for this?

From: Anonymous at: 2012-10-13 16:45:29

great tutorial

 

for centos 

/etc/httpd/conf/sites-available/ispconfig.vhost
 

From: at: 2012-11-25 21:57:01

I installed all ISPConfig thanks to this site and the answers of Falko and Till Brehm.

Yours, the new hosting guy, 

thanks. 

From: Ninja at: 2012-12-15 03:30:39

I installed per instructions and it seemed to be working, but I received an email from startssl that I needed to install  the intermediate CA certificate.  This appeared to be confirmed by checking my site in http://www.digicert.com/help/

I changed the  /etc/apache2/sites-available/ispconfig.vhost addition to:

SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt

and it seem to work and checked out in digicert.

 

From: at: 2013-04-07 15:27:43

Falko, You saved me a lot of time with this tutorial, and I'm sure a lot of others too... Outstanding tutorial!  Thank you!  Darin


 

 

From: Leonel Hernández at: 2013-05-17 22:16:55

hy Falko i want thanks you very much because i have done many of your tutorials and i have be out of mistakes :) THANKS ALOT brother keep working :) take CARE

From: Sascha at: 2013-05-21 10:25:29

Hi Falko,

as always...great job! Thank you very much.
Everything is working, except with monit. Here's the error on restart of the service:

Starting daemon monitor: Syntax error:
monit: The SSL server PEM file '/usr/local/ispconfig/interface/ssl/ispserver.pem' must be owned by you.
/etc/monit/monitrc:8: Error: SSL server PEM file has too loose permissions '/usr/local/ispconfig/interface/ssl/ispserver.pem'

 In fact, the file is owned by "ispconfig" rather than "root", which i presume munin expects.

What can i do?
Thank you very much

Sascha

From: monnoliv at: 2013-07-24 19:48:37

 Congratulation Falko, first time right!

Send me your photo, I'll create a bust in your effigy and I'll place it next to my PC :-)

 Thanks a lot,

 Olivier

From: Carlos Utrera at: 2013-09-13 17:31:34

Althought cert are working for postfix, courier, ... seems not work in apache. I have tested my site server.todo-host.com and has an default cert. What could be the problem? Centos 6.2 + Apache+Postfix+Courier+Ispconfig3.

I also have to mention that httpd get me this error when i restart:

Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using server.todo-host.com for ServerName

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost 80.82.222.129:443 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:443 has no VirtualHosts

[Fri Sep 13 18:58:46 2013] [warn] NameVirtualHost *:80 has no VirtualHosts

[  OK  ]

You could test here: https://sslcheck.globalsign.com/es/sslcheck if you find for server.todo-host.com you get a cert thaht seems to be first created in ispconfig.

 

From: at: 2013-11-26 18:20:36


CORRECT WORKING CONFIG FORMAT

[...]
ssl_cert = </etc/postfix/smtpd.cert
ssl_key = </etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca = </usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]

 
 
INCORRECT OBSOLETE CONFIG FORMAT

[...]
ssl_cert_file = /etc/postfix/smtpd.cert
ssl_key_file = /etc/postfix/smtpd.key
## must be re-added after an ISPConfig update!!!
ssl_ca_file = /usr/local/ispconfig/interface/ssl/startssl.chain.class1.server.crt
[...]

From: mlmateos at: 2015-05-18 18:31:23

PureFTPd 

To allow FTP and TLS sessions, run

echo 1 > /etc/pure-ftpd/conf/TLS

Then restart PureFTPd:

service pure-ftpd-mysql restart

From: till at: 2015-05-18 18:46:37

This command is already run in the perfect server guides. You have to run it a second time here only if you missed to enable TLS in the ispconfig setup tutorial.