Certificate ssl management

Languages:

English

Smeserver-certificate for SME Server 8 and 9

This contrib is made to help the managing of SSL certificates if you need to use commercial Certificates by example.

Maintainer

stephdl Stéphane de Labrusse AKA Stephdl

Version

Devel 10:

0.0.4-15

Contrib 10:

0.0.4-14

Contrib 9:

0.0.4-6

smeserver-certificate

The latest version of smeserver-certificate is available in the SME repository, click on the version number(s) for more information.

Description

This contribution for smeserver adds a panel in the server-manager in order to save the certificate, the secret key and eventually the intermediate certificate if needed without the use of the command line interface.

see that wiki page for more informations on how to set it manually

On SME Server by default, all services that require an SSL certificate using the same self-signed and re-generate every year (valid for one year). It is often useful to replace it with another certificate. This contrib give easier the procedure, which is valid both for an official certificate (purchased from Verisign or equivalent), an independent authority as CAcert, or private authority (eg, managed by PHPki).

The first step is of course to obtain a certificate. If it signed by a private CA, you should generate it with a wildcard (ie which will be valid for all subdomains of the main domain). It should be given by a *.domain.tld as the common name.. Then we need to get this certificate and the associated private key in a PEM format.

If you want to buy a commercial ssl certificate, you may need to do a 'csr' (certificate request), this is how to do that. Here an example with Gandi

• Generating an RSA key:

openssl genrsa -out mondomaine.com-key.pem 2048

• Generate the CSR

openssl req -new -key mondomaine.com-key.pem -out mondomaine.com.csr

You will need to answer to many questions, think about it before you type.

Installation

• for sme10

yum install smeserver-certificate --enablerepo=smecontribs

Go to the manage ssl certificate panel on Server Manager and past and save your full server.crt and full server.key (included -----BEGIN CERTIFICATE-----/-----END CERTIFICATE----- and -----BEGIN RSA PRIVATE KEY-----/-----END RSA PRIVATE KEY-----).

There is also the possibility of needing a custom certificate from an Intermediate Certificate Authority. If this is the case you'll get an additional CA certificate and you need to past into the box called 'SSL intermediate chain certificate'

Remember

• Each time you press Save, the web server is restarted so you may need to load again the page (F5 or ctrl+F5) and look about the SSL certificate displayed by your browser
• If you want to get back to the default SME Server certificates, simply blank all the contents and press save.
• If you set wrong certificates, the server Web may crash. You will have to do a command line in a root Terminal to get back to the default certificate :

signal-event certificate-revert

The bad certificates are not removed, but simply not used, then you can go back to the panel and see what is occurring with wrong certificates.

Testing

Here is a website you can use to test your certificates/server:

https://www.ssllabs.com/ssltest

Uninstall

yum remove smeserver-certificate; signal-event console-save

Bugs

Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-certificate component or use this link .

"No open bugs found."

Changelog

Only released version in smecontrib are listed here.

smeserver-certificate Changelog: SME 10 (smecontribs)

2024/03/01 Brian Read 0.0.4-14.sme
- Edit SM2 Menu entry to conform to new arrangements [SME: 12493]

2022/11/11 Jean-Philippe Pialasse 0.0.4-13.sme
- apply locale 2022-11-11 patch

2022/07/22 Jean-Philippe Pialasse 0.0.4-12.sme
- translation 2022-07-22 patch

2022/05/26 Brian Read 0.0.4-11.sme
- fix routes [SME: 11926]

2022/04/17 Brian Read 0.0.4-10.sme
- Add in updated lex file [SME: 11926]