Topic: SSL - How to reset all SSL related items - Help

[tstokovaz]

I've spent 5 hours trying to figure it out. I tried to install a Godaddy SSL certificate to replace the self generated one we were using. I read all I could and tried to follow the instructions. I did the make genkey and created and created the csr.  Got the gb_bundle.crt and our cert back. When I tried to install as instructed it broke the self generated key and no one can get to our website OR webmail. I was told that it is as if no ssl cert is installed.

I tried several things and all fail. Is there a way to reset this? I would just like to set up a self generated ssl cert and get it running again.

[cactus]

I've spent 5 hours trying to figure it out. I tried to install a Godaddy SSL certificate to replace the self generated one we were using. I read all I could and tried to follow the instructions. I did the make genkey and created and created the csr.  Got the gb_bundle.crt and our cert back. When I tried to install as instructed it broke the self generated key and no one can get to our website OR webmail. I was told that it is as if no ssl cert is installed.

I tried several things and all fail. Is there a way to reset this? I would just like to set up a self generated ssl cert and get it running again.

What is the output of:

Code: [Select]

db configuration show modSSL
It should list a crt and a key file. Are the files listed there present on your system? You can check by using

Code: [Select]

ls -la /path/to/crt

[tstokovaz]

This is what shows
[root@mail ~]# db configuration show modSSL
modSSL=service
    CertificateChainFile=/home/e-smith/gd_bundle.crt
    CipherSuite=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
    TCPPort=443
    access=public
    crt=/home/e-smith/ssl.crt/www.turningpnt.org.crt
    key=/home/e-smith/ssl.key/server.key
    status=enabled
[root@mail ~]#

And the output shows they are there.

 [root@mail ~]# ls -la /home/e-smith/ssl.crt/
total 3516
drwx------   3 root  root     4096 Mar 27 21:46 .
drwxr-xr-x  13 admin admin    4096 Mar 27 23:14 ..
-rw-r--r--   1 root  root     1842 Mar 27 16:16 mail.turningpnt.org.crt
-rw-r--r--   1 root  root     1318 Oct  6  2003 secure.turningpnt.org.crt.old
drwxr-xr-x   7 root  root     4096 Nov 18  2006 sg3
-rw-r--r--   1 root  root     1436 Sep  4  2004 shieldsserver.turningpnt.org.crt.old
-rw-r--r--   1 root  root  3560323 Jun 29  2004 squidguard3.2.tar.gz
-rw-r--r--   1 root  root     1842 Mar 27 16:16 ssl.crtOLD
-rw-r--r--   1 root  root     1842 Mar 27 16:16 www.turningpnt.org.crt
[root@mail ~]# ls -la /home/e-smith/ssl.key
total 20
drwx------   2 root  root  4096 Mar 27 17:37 .
drwxr-xr-x  13 admin admin 4096 Mar 27 23:14 ..
-rw-r--r--   1 root  root   887 Oct  6  2003 secure.turningpnt.org.key.old
-rw-r--r--   1 root  root   891 Mar 27 22:40 server.key
-rw-r--r--   1 root  root   887 Sep  4  2004 shieldsserver.turningpnt.org.key.old
[root@mail ~]#

What I don't see is the path to the bundled chain.  Is that the factor? And how to I fix that if it is?

I can't get to the admin web page and even on the server it doesn't let me go to server-manager. I CAN use putty and WinSCP to access, see files, do CL items, etc. I just don't know what is keeping the ssl from working.  I AM continuing to read, research, etc. I'm also making a back up and will set up a second system and try to restore. Not sure how that will work. But I've got to get it working. I appreciate any help. Sadly, I have a debian box that needs its SSL certificate replaced by Tuesday and I'm not feeling positive about that.

[cactus]

That looks pretty OK, sure your cetificate file (/home/e-smith/gd_bundle.crt) is also at the proper location?

Are the proper certificates in your webserver configuration file:

Code: [Select]

grep -nh \
-e 'CertificateChainFile' \
-e 'SSLCertificateFile' \
-e 'SSLCertificateKeyFile'\
 /etc/httpd/conf/httpd.conf
N.B. One other peace of advice, clean up the folders a bit as I see some files that should not be in there such as squidguard3.2.tar.gz.

[tstokovaz]

Thanks to those who offered suggestions. Turns out the GoDaddy certificate was incorrectly formatted (their error) and we had to do several steps listed in a couple of other posts. I will try to document the process (pulling together the various steps we had to take) and submit it for future use.

[chris burnat]

Reply #6 has been split to a separate topic:
http://forums.contribs.org/index.php/topic,43960.msg210499.html#msg210499