I am trying to follow along however I think I am an idiot when it comes to anything non-microsoft based. I have a Linux dedicated server through hosting.com and I am trying to install an SSL certificate onto a virtual server on this linux box from GoDaddy but have no idea how to generate the CSR and install the cert. Hosting.com gave me instruction for generating a CSR from the WEBMIN screen but i am not sure if that is correct. Please help.

-Damian

Without knowing what Hosting.com is telling you it is hard to say if the instructions are right or not. They don't seem to provide any doco without a login so I can't look it over.

That said, it is probably safe to assume that their own instructions are what you need to follow on their system . . .

What worked for me is detailed up the first page of this thread starting in post #8412. The shorthand for menu navigation that I am used to:
Virtualmin->Server Configuration->Manage SSL Certificate->Signing Request
Simply means you start on the Virtualmin screen, click on Server Configuration, click on Manage SSL Certificate, etc. If your host is giving you just Webmin (and not Virtualmin) then your path is obviously going to differ. Perhaps you could cut and paste a portion of it here and we could take a look?

The Hosting.com people also mention their Delightful Support. Have you tried them?

As Transmobius mentioned, the process is different depending on whether you're using Virtualmin or Webmin.

I'll take this opportunity to point out that Virtualmin GPL is free for Hosting.com to use...since you're a customer, you might mention it to them, if they are still just offering Webmin. If they need help with deployment, get them in touch with us. Offering just Webmin for hosting, when Virtualmin is so much easier to use for the purpose, is rather silly. Webmin is a wonderful tool for system administration, but it makes no claims to being a great tool for virtual hosting administration--it wasn't designed for that purpose, and Virtualmin is. We developed both, so we can say stuff like that. ;-)

When I go into my domain in virtualmin, then choose the CA Certificate tab, and then either try to upload or point to the path on the server of my gd_intermediate_bundle.crt file, when I click "save certificate" I immediately get the message "File not found" in firefox and "the page cannot be found" in IE6...

Help!

I hit a bug when I tried to edit but I wanted to add that I manually added the code to httpd.conf:

SSLCertificateChainFile /home/path/gd_intermediate_bundle.crt

and it works..

dear joe,
i bought Godaddy turbo ssl cert and i dont know how to use it for my webmin.. can you guide me on how to install this cert from scratch. I been trying to install for past one week and all the time it fails!

thanks in advance.

If I may add a few tidbits that may save someone like me a few hours:

I generated my private key & request files at the unix command line with openssl, sent the csr into godaddy and got my new cert. The problem I had was that I used the -des3 option that adds a password to the private key. Passworded private keys do not work well in webmin or its managed servers. Most of the servers fail with no usable error message telling you a password was needed. Took me an hour to figure this out again this year when renewing certs.

To fix the problem (i.e. not put a password on your private key)

1) do not use the -des3 option when generating the keys.

or

2) if you already have a passworded private key file, use this command to remove the password: openssl rsa -in key.pem -out keyout.pem

Hope this helps someone

http://lists.debian.org/debian-security-announce/2008/msg00152.html

This effects Debian Etch (v4.0) but not Sarge (v3.0) and any Debian derived distributions like Ubuntu.

After your system has been patched, you still have to regenerate any of your keys that were generated with OpenSSL since 2005. Plan on revoking and issuing new keys (OpenSSH, OpenVPN, SSL certificates, etc.)

OUCH!

That security alert is NOT that insecure as they claim it to be. They posted it as a precaution. The odds of anyone hacking any system with the old keys or hacking your sites with ssl are so slim it's not worth the hassle.

The debian people only put un-needed stress to it's own users.

Oh and only DEBIAN scared the crap out of its users. Not even RHEL people did anything about it.