SSL cert installation for admin area

SOLVED: SSL cert installation for admin area

I know there is lots of threads about this and I read trough them last 2 days and used a lot of suggestions but could not find help.

I have class2 certificate from startssl.com named ssl.crt
I downloaded their certificates:
ca.crt
ca-bundle.crt
sub.class1.server.ca.crt
sub.class2.server.ca.crt
sub.class3.server.ca.crt
sub.class4.server.ca.crt

and put all certificates into /root/ispconfig/httpd/conf/ssl.crt (the default ca-bundle.crt from ISPconfig renamed to ca-bundle.crt.ispconf)

I edited httpd.conf in /root/ispconfig/httpd/conf :

Code:

SSLCertificateFile /root/ispconfig/httpd/conf/ssl.crt/ssl.crt
SSLCertificateKeyFile /root/ispconfig/httpd/conf/ssl.key/server.key
SSLCertificateChainFile /root/ispconfig/httpd/conf/ssl.crt/sub.class2.server.ca.crt
SSLCACertificateFile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt 

I restarted server

All the same - browser deemed my certificate unsecure (not recognized authority).

I changed SSLCertificateChainFile and SSLCACertificateFile to all possible combinations, each time restarted server and cleared cache in browser. No joy.

When I do:

Code:

openssl verify -CAfile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt -purpose sslserver /root/ispconfig/httpd/conf/ssl.crt/ssl.crt

the result is OK but then I can't access admin area on port 81 (websites and emails works) = that is second problem I need help with, I have one live server I cant access admin area now This is working now. I had typo in httpd/conf/httpd.conf. I am able to access admin on this site after fixing typo and restarting ISPConfig.

What I am duing wrong? Where else I have to edit something?

More info: obviously I use https connection to admin area on port 81
the certificate is specific to the servers admin area - not valid for other domains (server2.mydomain.net)
systems are Debian Lenny (1x) and Debian Etch (1x)

Thanks very much for help.


Update
The certificate on the server which had typo is now working. I am going trough the other's conf file to make sure there is not a typo as well.
I am reinstalling ISPConfig on the second server once more and after I'll try to install certificate again. Will see what will happened.

 

Certificates are working. It was probably some other typo. If you need to install StartSSL.com certificate into admin area use this setup:

Class 2 certificate from startssl.com named ssl.crt
Download their certificates:
ca.crt
ca-bundle.crt
sub.class1.server.ca.crt
sub.class2.server.ca.crt
sub.class3.server.ca.crt
sub.class4.server.ca.crt

and put all certificates into /root/ispconfig/httpd/conf/ssl.crt (the default ca-bundle.crt from ISPconfig renamed to ca-bundle.crt.ispconf)

Edit httpd.conf in /root/ispconfig/httpd/conf :

Code:

SSLCertificateFile /root/ispconfig/httpd/conf/ssl.crt/ssl.crt
SSLCertificateKeyFile /root/ispconfig/httpd/conf/ssl.key/server.key
SSLCertificateChainFile /root/ispconfig/httpd/conf/ssl.crt/sub.class2.server.ca.crt
SSLCACertificateFile /root/ispconfig/httpd/conf/ssl.crt/ca-bundle.crt 

Restart server.

 

StartSSL.com for Vhosts

I have a similar issue installing the CA certificates for StartSSL.com for Vhosts. It installs once /etc/apache2/vhosts/Vhosts_ispconfig.conf is edited and following code added

Code:

# existing lines
SSLEngine on
SSLCertificateFile /var/www/some.site.com/ssl/site.crt
SSLCertificateKeyFile /var/www/some.site.com/ssl/site.key

#add these lines for Certificate Authority 
SSLCertificateChainFile var/www/some.site.com/ssl/sub.class1.server.ca.pem
SSLCACertificateFile var/www/some.site.com/ssl/ca.pem

Please ensure you replace some.site.com with the actual site name (folder path must exists).

See http://www.startssl.com/?app=21.
Make sure you download sub.class1.server.ca.pem and ca.pem from http://www.startssl.com/certs/. Store them in var/www/some.site.com/ssl/

Unfortunately, as soon you make any changes in ISPConfig web interface, the file /etc/apache2/vhosts/Vhosts_ispconfig.conf is overwritten. Falko, is there a way to fix this please? If you need help with modifying the php function that writes the Vhosts config file, maybe I can help. But a better fix would be to also re-work the SSL tab in ISPConfig so there is space for Certificate Authority Chain file and Certificate file.

 

SSLCACertificatePath

See http://www.howtoforge.com/forums/showthread.php?t=14569&page=3

Since /etc/apache2/vhosts/Vhosts_ispconfig.conf is dynamically generated by ISPC from info in db, it is suggested to add SSLCACertificateFile and SSLCertificateChainFile directives in /etc/apache2/apache2.conf or httpd.conf . This is not an ideal solution since it's not in the Virtual host directives because different vhosts may need different CA certificates.

After reading http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslcacertificatepath, best solution may be to use SSLCACertificatePath directive instead of either/both SSLCACertificateFile and SSLCertificateChainFile. We can add the following to /etc/apache2/apache2.conf file (last line after include Vhosts is ok)

Code:

Include /etc/apache2/vhosts/Vhosts_ispconfig.conf
SSLCACertificatePath /var/www/ssl_ca

In /var/www/ssl_ca we'll keep all the CA certificates from any/all trusted Certificate Authorities (client/site certificates under their respective directories handled by ISPConfig db). Make sure you only use "pem" encoded certificates.

From startssl.com, you only need following:

Code:

ca.pem
sub.class1.server.ca.pem
sub.class2.server.ca.pem
sub.class3.server.ca.pem
sub.class4.server.ca.pem

Unlike mentioned above, you don't need ca-bundle, which includes a lot of other unneeded certs and file size is over 90Kb. All the files above add up to less than 20Kb.

Every time you add/remove files to /var/www/ssl_ca, please remember to run:

Code:

c_rehash /var/www/ssl_ca

Hopefully, future ISPC releases can include a automatically run script to dynamically obtain (wget) the CA certs (all available online) from major/all browser trusted certificate authorities to keep the folder current -- this folder can be anywhere ISPConfig maintains dynamically maintained files (like Vhosts config files). All that will be needed then is just the site server key (private) and site server crt (public) manages by ISPConfig web interface.