Koozali.org: home of the SME Server
Obsolete Releases => SME Server 7.x => Topic started by: tstokovaz on March 27, 2009, 10:46:32 PM
-
I've spent 5 hours trying to figure it out. I tried to install a Godaddy SSL certificate to replace the self generated one we were using. I read all I could and tried to follow the instructions. I did the make genkey and created and created the csr. Got the gb_bundle.crt and our cert back. When I tried to install as instructed it broke the self generated key and no one can get to our website OR webmail. I was told that it is as if no ssl cert is installed.
I tried several things and all fail. Is there a way to reset this? I would just like to set up a self generated ssl cert and get it running again.
-
I've spent 5 hours trying to figure it out. I tried to install a Godaddy SSL certificate to replace the self generated one we were using. I read all I could and tried to follow the instructions. I did the make genkey and created and created the csr. Got the gb_bundle.crt and our cert back. When I tried to install as instructed it broke the self generated key and no one can get to our website OR webmail. I was told that it is as if no ssl cert is installed.
I tried several things and all fail. Is there a way to reset this? I would just like to set up a self generated ssl cert and get it running again.
What is the output of:
db configuration show modSSL
It should list a crt and a key file. Are the files listed there present on your system? You can check by usingls -la /path/to/crt
-
This is what shows
[root@mail ~]# db configuration show modSSL
modSSL=service
CertificateChainFile=/home/e-smith/gd_bundle.crt
CipherSuite=ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
TCPPort=443
access=public
crt=/home/e-smith/ssl.crt/www.turningpnt.org.crt
key=/home/e-smith/ssl.key/server.key
status=enabled
[root@mail ~]#
And the output shows they are there.
[root@mail ~]# ls -la /home/e-smith/ssl.crt/
total 3516
drwx------ 3 root root 4096 Mar 27 21:46 .
drwxr-xr-x 13 admin admin 4096 Mar 27 23:14 ..
-rw-r--r-- 1 root root 1842 Mar 27 16:16 mail.turningpnt.org.crt
-rw-r--r-- 1 root root 1318 Oct 6 2003 secure.turningpnt.org.crt.old
drwxr-xr-x 7 root root 4096 Nov 18 2006 sg3
-rw-r--r-- 1 root root 1436 Sep 4 2004 shieldsserver.turningpnt.org.crt.old
-rw-r--r-- 1 root root 3560323 Jun 29 2004 squidguard3.2.tar.gz
-rw-r--r-- 1 root root 1842 Mar 27 16:16 ssl.crtOLD
-rw-r--r-- 1 root root 1842 Mar 27 16:16 www.turningpnt.org.crt
[root@mail ~]# ls -la /home/e-smith/ssl.key
total 20
drwx------ 2 root root 4096 Mar 27 17:37 .
drwxr-xr-x 13 admin admin 4096 Mar 27 23:14 ..
-rw-r--r-- 1 root root 887 Oct 6 2003 secure.turningpnt.org.key.old
-rw-r--r-- 1 root root 891 Mar 27 22:40 server.key
-rw-r--r-- 1 root root 887 Sep 4 2004 shieldsserver.turningpnt.org.key.old
[root@mail ~]#
What I don't see is the path to the bundled chain. Is that the factor? And how to I fix that if it is?
I can't get to the admin web page and even on the server it doesn't let me go to server-manager. I CAN use putty and WinSCP to access, see files, do CL items, etc. I just don't know what is keeping the ssl from working. I AM continuing to read, research, etc. I'm also making a back up and will set up a second system and try to restore. Not sure how that will work. But I've got to get it working. I appreciate any help. Sadly, I have a debian box that needs its SSL certificate replaced by Tuesday and I'm not feeling positive about that.
-
That looks pretty OK, sure your cetificate file (/home/e-smith/gd_bundle.crt) is also at the proper location?
Are the proper certificates in your webserver configuration file:
grep -nh \
-e 'CertificateChainFile' \
-e 'SSLCertificateFile' \
-e 'SSLCertificateKeyFile'\
/etc/httpd/conf/httpd.conf
N.B. One other peace of advice, clean up the folders a bit as I see some files that should not be in there such as squidguard3.2.tar.gz.
-
Thanks to those who offered suggestions. Turns out the GoDaddy certificate was incorrectly formatted (their error) and we had to do several steps listed in a couple of other posts. I will try to document the process (pulling together the various steps we had to take) and submit it for future use.
-
Reply #6 has been split to a separate topic:
http://forums.contribs.org/index.php/topic,43960.msg210499.html#msg210499