Topic: Advanced - how to install PositiveSSL certificate

[Amir Inbar]

After reading a lot about certificates and about the ways available to transfer them to SME server i need some help doing it in an advanced server setup.

Here is the production setup :

Sme 7.5.1 server as a gateway, configured to act as a "spam snake" to an internal Exchange server.
Sme is also a VPN server to external workers configured with open-vpn-bridge and PHPki - clients use openvpn software to connect.
Exchange is accessible from outside using ProxyPass for Exchange from here : http://forums.contribs.org/index.php/topic,40075.0.html through OWA (outlook web access).
Sme is also the public web site of the organization containing a custom built web site.
The operation mode is Server and Gateway.

The problems :

I was asked to install a certificate that will not need to be installed on outside user's browsers so i have bought an affordable PositiveSSL certificate.

1. I want to install the cert without harming remote vpn users ability to connect to the server by VPN or by OWA.
2. When activating the certificate I'm asked to choose the cert type : Apache, Apache + ApacheSSL, Apache + MOD SSL, Apache + OpenSSL, or Apache2 - what should i choose to best fit my setup ?
3. Should i use PHPki or the instructions mentioned here : http://wiki.contribs.org/Certificates_Concepts to install the PositiveSSL to the server ?

Any help would be very much appreciated - TNX.

[Amir Inbar]

Anyone knows how to help me do this ?

[Jáder]

Anyone knows how to help me do this ?

Did you read this: http://wiki.contribs.org/Custom_CA_Certificate and this http://wiki.contribs.org/Certificates_Concepts ??

[Amir Inbar]

jader thank you for the reply !
Yes i have read those but there are my 2 questions still open and not answered by those pages :
1. can i install a new cert (paid one) over the old (phpki generated) without causing the vpn connected users loose the ability to connect until they renew the cert ?
2. what kind of cert should i define while activating the commercial cert ?

[Stefano]

jader thank you for the reply !
Yes i have read those but there are my 2 questions still open and not answered by those pages :
1. can i install a new cert (paid one) over the old (phpki generated) without causing the vpn connected users loose the ability to connect until they renew the cert ?
 

what kind of vpn are you talking about? pptpd is not influenced by ssl certs.. and openvpn use its own cert, AFAIK

[Amir Inbar]

openvpn - it uses the certificates i generated with phpki

[Stefano]

openvpn - it uses the certificates i generated with phpki

then it uses its own certs

[Amir Inbar]

Stefano,
openvpn uses a pem file generetaed for each user AND also the CA certificate of the server - without the root certificate the openvpn client will not work.

here is the openvpn-bridge contrib that explains the proccess :
http://wiki.contribs.org/OpenVPN_Bridge#Configure_OpenVPN_with_the_newly_created_certificates
and also here :
http://wiki.contribs.org/OpenVPN_Bridge#Windows