I've been working on installing a godaddy certificate and was wondering if anyone else has done the same with Virtualmin? This is one of those funky (but cheap) intermediate certificates. See this thread for more background: http://www.virtualmin.com/forums/general-discussion/certificate-options....
Anyway, the idea is to install 2 certificates as part of your "Chain". Your certificate as well as an intermediate cert. from Godaddy. I'm having trouble translating their instructions to a Virtualmin setup.
- Copy your issued certificate, intermediate certificate and key file (generated when you created the Certificate Signing Request (CSR)) into the directory that you will be using to hold your certificates.
- Open the Apache ssl.conf file and add the following directives: * SSLCertificateFile /path to certificate file/your issued certificate * SSLCertificateKeyFile /path to key file/your key file * SSLCertificateChainFile /path to intermediate certificate/gd_intermediate_bundle.crt
- Save your ssl.conf file and restart Apache.
Basically, instead of copying the files to a directory on the webserver, I installed my new cert via the "Mange SSL Certificate->New Certificate" menu.
But how do I install the intermediate cert? I have created this directive in my ssl.conf file. * SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
Will Apache know to use this for my certificate? Will it interfere with other certificates? Whill the Atlanta Hawks ever field a decent basketball team?<br><br>Post edited by: JimJenkins, at: 2007/07/17 16:54
Re:GODaddy SSL Certificate
Hey Jim,
Yep, it's been done. You're using one here at Virtualmin.com. We're cheap, and we know how to use chained certificates. It's a dangerous combination. ;-)
That said, I set ours up manually before any of the SSL handling stuff in Virtualmin had gotten reasonable (it still needs a little bit more work).
Here's the relevant VirtualHost section on our system (note that I said VirtualHost--the chain file probably ought to be set per-domain, though I can't be sure that's necessary, as it is the same for all that are purchased from the same folks...godaddy in my case and yours):
SSLEngine on SSLCertificateFile /home/virtualmin/etc/certs/certfile.pem SSLCertificateKeyFile /home/virtualmin/etc/certs/keyfile.pem SSLCertificateChainFile /home/virtualmin/virtualmin/certs/sf_issuing.crt
Virtualmin's SSL management doesn't yet handle chained certs (I'll ask Jamie to add it), so the SSLCertificateChainFile will need to be added manually.
And, no, I'm guessing the Hawks will not field a decent team in our lifetime. (But, ya'know, the Houston Rockets were an also-ran until 1993...and now have become an also-ran again. Things change.) ;-)
Oh, yeah, you can also use this kind of cert for Postfix with these directives:
smtpd_tls_cert_file = /etc/postfix/virtualmin.pem smtpd_tls_CAfile = /etc/postfix/sf_issuing.crt
Though it looks like I combined the key and the cert into a pem for Postfix use (I don't think this is necessary...not sure why I went that route.)
And Dovecot:
ssl_cert_file = /home/virtualmin/etc/certs/virtualmin-chained.cert ssl_key_file = /home/virtualmin/etc/certs/keyfile.cert
Same story here, only with the chain and the cert combined--I think this one was actually necessary to make Dovecot use the chain.
cat sf_issuing.crt certfile.pem > chained.cert
I don't use FTP, but you could do the same for ProFTPd with the TLSCertificateChainFile directive.<br><br>Post edited by: Joe, at: 2007/07/18 01:02
Re:GODaddy SSL Certificate
dear joe, i bought Godaddy turbo ssl cert and i dont know how to use it for my webmin.. can you guide me on how to install this cert from scratch. I been trying to install for past one week and all the time it fails!
thanks in advance.
Re:GODaddy SSL Certificate
SteveACup wrote: If I may add a few tidbits that may save someone like me a few hours: ... 2) if you already have a passworded private key file, use this command to remove the password: openssl rsa -in key.pem -out keyout.pem
Hope this helps someone
This helped me out. Thanks!
Another tidbit: If you do have your pem file passworded, you can do "/etc/rc5.d/S99webmin start" as root in the console and enter the PEM password to start webmin.
Re:GODaddy SSL Certificate
Hi adamcharnock, sorry about the delay in replying.
First, my /home/$DOMAIN/ssl.chained.cert does NOT have trailing ^M characters so I would probably start by (backing up and) rebuilding that file.
Also, the error, and your '/xxx/xxx/xxx/xxx.key', look like you may be pointing to the wrong file. Or maybe it's just one too many /xxx in your obfuscated path. My ssl files are in /home/$DOMAIN/, perhaps your's are in /home/$DOMAIN/ssl/ ? Hmmm, that'd be a bit cleaner, may do that . . .
Next, this is the appropriate section from my /etc/proftpd/proftpd.conf
it is somewhat changed from my earlier post:
<IfModule mod_tls.c> TLSEngine on TLSRequired on TLSVerifyClient on TLSProtocol SSLv23 TLSRSACertificateFile /home/$DOMAIN/ssl.chained.cert TLSRSACertificateKeyFile /home/$DOMAIN/ssl.key TLSCipherSuite ALL:!ADH:!DES TLSLog /var/log/proftpd/tls.log
TLSOptions NoCertRequest
</IfModule>
(Obviously, you must replace $DOMAIN with your actual domain)
Note that the above ONLY allows encrypted connections, to also allow non-encrypted sessions use 'TLSRequired off'.
A good reference page for the ProFTPd TLS stuff is at http://www.castaglia.org/proftpd/modules/mod_tls.html
Cheers
Re:GODaddy SSL Certificate
Did this ever make it in the wiki? I'm having trouble, though I've followed all the steps here and hoping a doc may help.
Re:GODaddy SSL Certificate
What sorts of trouble are you having?
Adding a GoDaddy cert in general, or getting it to work with ProFTP? -Eric
Re:GODaddy SSL Certificate
The most common certs are only good for one host, so if you generate your CSR with "ssl.domain.com" you'd want to use that host in the setup for your mail client.
The instructions listed here work flawlessly for adding a cert to a domain - plus the kluges for using a single cert for webmin and virtualmin work as well- however, in addition to setting up the domain itself, webmin, and virtualmin, I recommend adding the same SSL setting for the Usermin setup, too!
I also added a couple entries to httpd.conf
ServerAlias webmail.nonsecuredomain.com
RewriteCond %{HTTP_HOST} =webmail.nonsecuredomain.com RewriteRule ^(.*) https://secureddomain.com:20000/ [R]
This way I can get my webmail at any domain on the box and it routes to the real SSL certified domain without those irritating security warnings.
Re:GODaddy SSL Certificate
I'm planning on getting a GoDaddy SSL cert this week, any update to the above?
Another related question, if I get the cert for www.MyDomain.com should I spec that as my POP3/SMTP servers in my mail client (as opposed to mail.MyDomain.com or just MyDomain.com)?
Re:GODaddy SSL Certificate
I believe chained certs are now configurable in Virtualmin. If not, they will be soon (and the above docs should get you there).
Yes, if your cert is www.domain.tld, then everything that uses the cert needs to be talking to www.domain.tld, or it will result in a security warning.
Re:GODaddy SSL Certificate
It looks like it knows about chained certificates: Virtualmin->Server Configuration->Manage SSL Certificate->CA Certificate "If your virtual server's SSL certificate is from a certificate authority that is not directly known to major browsers, you may need to upload the CA's certificate using this form."
I'll find out and report back in a couple of days.
On the mail servers question, if I wanted to maintain both a 'www.' cert for browsers and a 'mail.' cert for POP/SMTP/IMAP would your interface allow this, or is it back to the command line?
Re:GODaddy SSL Certificate
More GoDaddy info.
They offer 'Single' certs that, they say, if issued after 2006 will secure the domain name, with or without the www prefix. Has anyone tried this? See: [url]http://help.godaddy.com/article.php?article_id=850&topic_id=234[/url]
They also offer 'Multiple Domain (UCC)' and 'Wildcard' certificates for A LOT more money. Multiple would be a single certificate for many separate domains!? And Wildcard seems to let you use just one certificate for how ever many subdomains your domain has.
Both are interesting. But it would still be cheaper to have two singles at $19/year. And if Virtualmin could plug-in two (www and mail) it would be a no brainer.
Re:GODaddy SSL Certificate
Easier than I can believe.
Virtualmin->Server Configuration->Manage SSL Certificate->Signing Request Fill in the blanks ('Server name in URL' needs the 'www' but not 'http://'), click 'Generate Now', copy the result Log in to GoDaddy, buy a certificate credit, use the credit to request a certificate (they have instructions) Paste in the CSR you got from clicking 'Generate Now' They e-mail you a link to a zip file containing your cert and a chain called 'gd_intermediate_bundle.crt' Unzip the file Virtualmin->Server Configuration->Manage SSL Certificate->New Certificate Upload your cert into 'Signed SSL certificate' Virtualmin->Server Configuration->Manage SSL Certificate->CA Certificate Upload the chain into 'CA certificate file' Restart Apache
Dovecot Webmin->Servers->Dovecot->SSL Configuration (No chain needed?) SSL certificate file /home/YOURDOMAIN/ssl.cert SSL private key file /home/YOURDOMAIN/ssl.key Save, Restart Dovecot
Postfix Webmin->Servers->Postfix->SMTP Authentication Enable TLS encryption? Yes TLS certificate file /home/YOURDOMAIN/ssl.cert TLS private key file /home/YOURDOMAIN/ssl.key TLS certificate authority /home/YOURDOMAIN/ssl.ca Save, Restart Postfix
ProFTPd This takes just a bit more effort. It requires the chain file (now residing at /home/YOURDOMAIN/ssl.ca) and your cert together. Login to your system and cat ssl.ca ssl.cert > ssl.chained.cert Webmin->Servers->ProFTPD Server->Edit Config Files
(Explanation at: http://www.castaglia.org/proftpd/modules/mod_tls.html)
FIND THIS SECTION (ABOUT HALF WAY DOWN): <IfModule mod_tls.c> TLSEngine off </IfModule>
AND CHANGE IT TO READ:
<IfModule mod_tls.c>
TLSEngine off
</IfModule>
TLSEngine on TLSRequired on TLSRSACertificateFile /home/YOURDOMAIN/ssl.chained.cert TLSRSACertificateKeyFile /home/YOURDOMAIN/ssl.key
TLSCipherSuite ALL:!ADH:!DES
Save, Restart ProFTPd
Re:GODaddy SSL Certificate
Thanks for the great info Transmobius. I have yet to get PROFTPD to work properly though. I kept getting the following in my tls log:
Nov 26 11:19:45 mod_tls/2.1.2[24181]: error loading TLSRSACertificateKeyFile '/xxx/xxx/xxx/xxx.key': (1) error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
Which seemed odd because everything was working fine with apache, so I can only conclude that I made a mistake when creating the chained crt file.
Also, I am not sure if this will help anyone, but the chained file I crated seemed to have the dos-style (^M) line endings, so I passed it thourgh the dos2unix command but it did not seem to help (in my case, anyway).
It is not a big deal for me at the moment, I have bigger fish to fry, but I will report back if I find a solution.
Thanks again,
Adam
Re:GODaddy SSL Certificate
Forgot one, Webmin itself.
Webmin->Webmin->Webmin Configuration->SSL Encryption
Private key file /home/YOURDOMAIN/ssl.key Certificate file Separate file: /home/YOURDOMAIN/ssl.cert Redirect non-SSL Yes Additional cert /home/YOURDOMAIN/ssl.ca
Prolly time to add this to the Wiki . . .
Re:GODaddy SSL Certificate
Dovecot DOES need the chaining certificate.
Webmin->Servers->Dovecot->Edit Config File (Tap PageDown about 5 times) ssl_ca_file = /home/YOURDOMAIN/ssl.ca
(Would be nice if this had a Webmin field like Postfix)
Re:GODaddy SSL Certificate
Awesome research Transmobius! Definitely going in the wiki. And I'll bug Jamie again about getting all of this a bit easier to configure in the respective Webmin modules, and probably in Virtualmin itself--since the mail services can only really have one certificate, it makes sense to have a single place to configure it for Webmin's "default" (Webmin can serve other certs on other IPs, though), the mail servers and ProFTPd on the default IP.
Re:GODaddy SSL Certificate
I am trying to follow along however I think I am an idiot when it comes to anything non-microsoft based. I have a Linux dedicated server through hosting.com and I am trying to install an SSL certificate onto a virtual server on this linux box from GoDaddy but have no idea how to generate the CSR and install the cert. Hosting.com gave me instruction for generating a CSR from the WEBMIN screen but i am not sure if that is correct. Please help.
-Damian
Re:GODaddy SSL Certificate
As Transmobius mentioned, the process is different depending on whether you're using Virtualmin or Webmin.
I'll take this opportunity to point out that Virtualmin GPL is free for Hosting.com to use...since you're a customer, you might mention it to them, if they are still just offering Webmin. If they need help with deployment, get them in touch with us. Offering just Webmin for hosting, when Virtualmin is so much easier to use for the purpose, is rather silly. Webmin is a wonderful tool for system administration, but it makes no claims to being a great tool for virtual hosting administration--it wasn't designed for that purpose, and Virtualmin is. We developed both, so we can say stuff like that. ;-)
Re:GODaddy SSL Certificate
Damian,
you wanna go with SSL provider's website? there do offer live chat SSL installation support. I have experienced with Rapidsslonline.com. I got RapidSSL only at $15 and they do live chat support. I hope these guys can help you.. Wanna try?
X Kevin.......
Re:GODaddy SSL Certificate
Without knowing what Hosting.com is telling you it is hard to say if the instructions are right or not. They don't seem to provide any doco without a login so I can't look it over.
That said, it is probably safe to assume that their own instructions are what you need to follow on their system . . .
What worked for me is detailed up the first page of this thread starting in post #8412. The shorthand for menu navigation that I am used to: Virtualmin->Server Configuration->Manage SSL Certificate->Signing Request Simply means you start on the Virtualmin screen, click on Server Configuration, click on Manage SSL Certificate, etc. If your host is giving you just Webmin (and not Virtualmin) then your path is obviously going to differ. Perhaps you could cut and paste a portion of it here and we could take a look?
The Hosting.com people also mention their Delightful Support. Have you tried them?
Re:GODaddy SSL Certificate
When I go into my domain in virtualmin, then choose the CA Certificate tab, and then either try to upload or point to the path on the server of my gd_intermediate_bundle.crt file, when I click "save certificate" I immediately get the message "File not found" in firefox and "the page cannot be found" in IE6...
Help!
Re:GODaddy SSL Certificate
I hit a bug when I tried to edit but I wanted to add that I manually added the code to httpd.conf:
SSLCertificateChainFile /home/path/gd_intermediate_bundle.crt
and it works..
Re:GODaddy SSL Certificate
If I may add a few tidbits that may save someone like me a few hours:
I generated my private key & request files at the unix command line with openssl, sent the csr into godaddy and got my new cert. The problem I had was that I used the -des3 option that adds a password to the private key. Passworded private keys do not work well in webmin or its managed servers. Most of the servers fail with no usable error message telling you a password was needed. Took me an hour to figure this out again this year when renewing certs.
To fix the problem (i.e. not put a password on your private key)
1) do not use the -des3 option when generating the keys.
or
2) if you already have a passworded private key file, use this command to remove the password: openssl rsa -in key.pem -out keyout.pem
Hope this helps someone
Cryptographic weakness on Debian systems
http://lists.debian.org/debian-security-announce/2008/msg00152.html
This effects Debian Etch (v4.0) but not Sarge (v3.0) and any Debian derived distributions like Ubuntu.
After your system has been patched, you still have to regenerate any of your keys that were generated with OpenSSL since 2005. Plan on revoking and issuing new keys (OpenSSH, OpenVPN, SSL certificates, etc.)
OUCH!
Re:Cryptographic weakness on Debian systems
That security alert is NOT that insecure as they claim it to be. They posted it as a precaution. The odds of anyone hacking any system with the old keys or hacking your sites with ssl are so slim it's not worth the hassle.
The debian people only put un-needed stress to it's own users.
Re:Cryptographic weakness on Debian systems
Oh and only DEBIAN scared the crap out of its users. Not even RHEL people did anything about it.
Re:Cryptographic weakness on Debian systems
That's because it only effected Debian and Ubuntu versions of OpenSSL.
RHEL was not impacted, because RHEL didn't break it in their packages. This was a very specific problem, caused by a very specific change made by a Debian developer to the Debian package. So, only Debian, and Ubuntu which is 90% the work of Debian developers, had the problem.
But, I do agree that the problem is possibly overblown. However, github reported seeing several identical keys from different people--which is a pretty serious problem. If that's the case in their relatively tiny userbase, then it would definitely be possible for a cracker to generate a few hundred keys using the buggy library, and then make a brute force attempt on millions of sites. They'd get a few hits, I reckon--though it would probably also take months. I don't know that any black hat will be determined enough to exploit this specific hole rather than going after lower hanging fruit (like Windows boxes running unpatched IE, Outlook, etc.) which can be found at a rate of hundreds or thousands per day of searching. But, if I had any keys impacted by this I would revoke them and make new ones. All of my keys, including the Virtualmin package signing keys, were made on Fedora systems.
Re:Cryptographic weakness on Debian systems
There is only 1(ONE) !!!! SSL provider that is offering a replacement cert for free because of this.
Try to sell that to the other 10 billion debian users that use godaddy or other cert providers that wont.
Re:Cryptographic weakness on Debian systems
A update to this.....
http://isc.sans.org/diary.html?storyid=4543
To quote: So Where Are Those OpenSSH Key-based Attacks?
One of our readers contacted the handler on duty to see if we had seen any reports since then of active attacks concerning this attack vector. The standard SSH port (22/tcp) has been at normal levels for the past several weeks with one exception (on May 27-28) per the data at Dshield.
End quote
I told you it was all hype -- not one ssl site has been hacked nor has there been any significant reports about any type ssh/ssl hacking.
Re:GODaddy SSL Certificate
Hi Guys
I would really appreciate a 1.2.3 guide on how to set up TSL or SSL on postfix and dovecote to secure email on one virtual host. I have a godaddy ssl cert and have set up the domain to work on ssl. I have had a look about in the forums and in the Virtualmin docs and this topic seems a little light on documentation.
Cheers in advance for any pointers or input on this.
s
Re:GODaddy SSL Certificate
Well, Transmobius's message at the beginning of this thread should take you from start to finish on a GoDaddy SSL cert:
http://www.virtualmin.com/forums/general-discussion/godaddy-ssl-certific...
I'm not sure if that information ever made it into the docs, but if not, it probably should :-) -Eric
Re:GODaddy SSL Certificate
Hi Dude,
Why you go with chain root SSL certificate? Wanna go for Direct ROOT level SSL certificate. There are so many root level SSL providers are available.. www.thawte.com
Re:GODaddy SSL Certificate
Hey guys, cut out the spamming of SSL providers. Not the place for it. ;-)
Chained certificates work fine, and it's what we use here at Virtualmin.com (from GoDaddy, even). I've never used one in ProFTPd, though, as I don't use FTP, so I don't have a lot of useful advice on the topic. But it looks like you're trying to use the wrong private key (or perhaps one that has a passphrase that isn't being provided) for your certificate. Double check your configuration to be sure you're providing a certificate, a key, and the CA (chained certificate authority) files.
Re:GODaddy SSL Certificate
Hi all
I also had trouble installing a GoDaddy SSL certificate. My problem was that I did not add the CA certificate from GoDaddy in virtualmin. This led to problems in FF but not in IE. I did not find the ca certificate on the pages of godaddy.com, a friend had to mail me the certificate.
Also the process of adding a seperate virtual ip for each ssl-domain is not well documented. I am not sure where in virtualmin a second ip should be entered to run correctly. It would be nice if there was more inline help from virtualmin or a wizard for setting up such things.
regards! Chris
Re:GODaddy SSL Certificate
It would be nice if there was more inline help from virtualmin or a wizard for setting up such things.
But there is a wizard for SSL, I thought. And it includes a spot for the chain certificate.
How long ago was it that you had problems?
Anyway, this one is specific to ProFTPd, which does need better support for SSL in Virtualmin.
Re:GODaddy SSL Certificate
Thanks to all who contributed to this, I've had the GoDaddy wildcard cert for a while (*.domain) and had just not got around to putting it all together. Thanks to this I got it all done and setup with a minimum of fuss.
One thing to either add to the wiki or for others to note : You'll also need to add the same details to the usermin section. It's fairly explanatory and is very similar to the webmin section.
Cheers, Nick
Possible missing step?
I really like the way Virtualmin makes it easy to install SSL certificates.
Maybe I glanced over it but I think its worth mentioning again...
The option... Virtualmin->Server Configuration->Manage SSL Certificate (as Transmobius pointed out in his 2007-11-18 post)
Is only available if you have Virtualmin->Edit Virtual Server->Enable Feature and select '[X] Select SSL website enabled?'
I've created the following
I've created the following google doc for now, until this gets into the Wiki; if there is a format I can export it as that will help (odt?), let me know.
Comments are enabled to the public, so you can add your own notes and I will revise it for now. I will also be revising over the next day or two while I go through this process myself.
https://docs.google.com/document/d/1kvj4VLq3NnkpiGMFY-E97N84m2310vPtrzRs...