3,240
edits
Changes
From SME Server
Jump to navigationJump to searchno edit summary
SME 10 also offers SNI support for your apache web server. SNI is a technology allowing recent browser to wait for a specific answer allowing the server to know what domain they want to access before starting the encrypted transaction, this allow httpd to choose the appropirate certificate if multiple are available.
SME 10 also offers SNI support for your apache web server. SNI is a technology allowing recent browser to wait for a specific answer allowing the server to know what domain they want to access before starting the encrypted transaction, this allow httpd to choose the appropirate certificate if multiple are available.
SME Server is designed in a way that the same certificate is shared between all the exposed services offering SSL/TLS communication to a user : httpd, pop, imap, ftp, radiusd, ldap, smtp. The practical approach is if all your hosted domain are included in the SSL ceertificate for httpd... then you can also connect to the imap and smtp using the same domains without any alert from the client software.{{usefulnote}}
SME Server is designed in a way that the same certificate is shared between all the exposed services offering SSL/TLS communication to a user : httpd, pop, imap, ftp, radiusd, ldap, smtp. The practical approach is if all your hosted domain are included in the SSL certificate for httpd... then you can also connect to the imap and smtp using the same domains without any alert from the client software.{{usefulnote}}
===Self signed certificates===
===Self signed certificates===
The certificate created by sme by default is a self signed certificate. That means it is issued by SME Server and as such has not been tested or authenticated by any external certificate issuing Authority eg VeriSign & others etc.
The certificate created by sme by default is a self signed certificate. That means it is issued by SME Server and as such has not been tested or authenticated by any external certificate issuing Authority eg VeriSign & others etc.
config setprop modSSL CommonName www.domain.com
config setprop modSSL CommonName www.domain.com
signal-event ssl-update
signal-event domain-modify
{{Note box | The public certificate (crt) is derived from the private key, so the key has to be generated first before you can generate the certificate otherwise generating of the certificate will fail with cryptic messages}}
{{Note box | The public certificate (crt) is derived from the private key, so the key has to be generated first before you can generate the certificate otherwise generating of the certificate will fail with cryptic messages}}
/home/e-smith/ssl.key/
/home/e-smith/ssl.key/
In the process of copying it is OK to overwrite the existing files if they are the same name.
It's also a good idea to delete any existing files in those folders, to keep your system clean.
In the process of copying it is NOT OK to overwrite the existing files if they are the self signed generated certificate, as SME will generated them on a regular basis as a failsafe in case something goes wrong with your other certificates.
It is a good idea to delete any existing files in those folders, to keep your system clean, except for the one in use and the self generated ones.
{{Warning box|SME Server 10 and above will maintain a self signed certificate on all time using the hostname and primary domain to generate the name of the files. If you happen to use the same filename for your commercial certificates they will be overwritten on next running event or cron task.}}
Then issue the following db commands so that sme server knows about these these "commercial certificate" files, rather than using the default "self signed" certificate files.
Then issue the following db commands so that sme server knows about these these "commercial certificate" files, rather than using the default "self signed" certificate files.
config setprop modSSL crt /home/e-smith/ssl.crt/{domain}.crt
config setprop modSSL crt /home/e-smith/ssl.crt/imported_{domain}.crt
config setprop modSSL key /home/e-smith/ssl.key/{domain}.key
config setprop modSSL key /home/e-smith/ssl.key/imported_{domain}.key
Note to replace {domain}.crt and {domain}.key with the actual names of your files eg
Note to replace {domain}.crt and {domain}.key with the actual names of your files eg
yourdomain.com.crt and yourdomain.com.key
yourdomain.com.crt and yourdomain.com.key
Follow the above commands with either:
Follow the above commands :
signal-event console-save
signal-event ssl-update
When initially creating and ordering the certificate and supplying the domain name(s) to your chosen commercial supplier, you must include all domains that your server is hosting. sme server only supports one ssl certificate, so therefore to avoid errors for https access using any hosted domain name, the certificate must be created correctly. sme does not cater for multiple certificates for different domains, as it is not technically possible.
When initially creating and ordering the certificate and supplying the domain name(s) to your chosen commercial supplier, you must include all domains that your server is hosting. sme server only supports one ssl certificate, so therefore to avoid errors for https access using any hosted domain name, the certificate must be created correctly. sme does not cater for multiple certificates for different domains, as it is not technically possible.
db domains shop.myownbusiness.tld setprop DomainSSLCertificateChainFile /home/e-smith/shop.myownbusiness.tld/chain.pem
db domains shop.myownbusiness.tld setprop DomainSSLCertificateChainFile /home/e-smith/shop.myownbusiness.tld/chain.pem
signal-event remote-access update
signal-event ssl-update
</syntaxhighlight>
</syntaxhighlight>
* Apply the changes:
* Apply the changes:
signal-event post-upgrade; signal-event reboot
signal-event ssl-update
You can use the service at https://ssltools.geotrust.com/checker/views/certCheck.jsp to check your installation.
You can use the service at https://ssltools.geotrust.com/checker/views/certCheck.jsp to check your installation.
