How to Add An SSL Certificate to an Ispconfig website with Starssl

Some years ago i discovered this useful service for generating Class 2 webserver certificates, very useful to offer your user a secure, encrypted connection over wich they can send their data reducing the risks of being sniffed (i’ll write something about sniffing).

Good news! We can obtain our SSL certificate for free.
Just follow this tutorial and you will end up with a new FREE SSL certificate for your domain(s).

Let’s login on the ISPConfig admin web interface

 http://www.yourispconfigsite.org:8080 

Choose the website you are about to install the certificate for from the “Sites” panel. In the first tab of the Web Domain management check the SSL checkbox and save. As follows:

This picture shows the ISPConfig admin panel, where you can enable teh SSL features from a single client domain or subdomain.

Then, go to the SSL tab of the Web Domain management, select “CREATE CERTIFICATE” from the “SSL ACTION” dropdown menu at the bottom of the page, then save. Just like the following picture:

This picture describes the process to be followed in order to obtain a CSR certificate request for a client Web Site directly within the ISPConfig3 admin panel.

This will end like the following image:

This image shows what you will get right after the CSR creation

Now we have to go through several steps on starssl website, but don’t worry as it is all well documented and anyone can succesfully install an SSL certificate.
If you are here, you probably already have or will have soon a starssl.com account so let’s login to Starssl.com and go to your “Control panel”, and then select “Validation Wizard” from the three tabs on the middle-left of the page, as shown in the following picture:

How to go to the starssl validation wizard

Now, you have to validate your domain: this is for starssl to be sure you are the owner of the domain or, at least, authorized to act as the owner; basically starssl will do a whois query, extracting all email addresses related to the choosen domain and it will prompt them to you for choosing the one on wich you want to receice a confirmation code to validate the domain.
You should see yours here. If it is not, you should manage to be so and unless you have done, you cannot go further on this guide.
Here select “Domain Name Validation” from the drop down and hit “Continue”.
The following image shows this step:

In this picture is shown the initial validating process for a domain name.

Now you have to insert the TLD domain you want to secure in this form, as follows. Don’t use subdomains even if you want to secure just one of them, the TLD is mandatory and the certificate file will work for both (domain and subdomain). Carefully chosse the domain extension and hit “Continue”

You can see here how to fill the domain name field on the domain validation form on starssl

This image shows how to select the recipient for the starssl domain verification code.

Then you will receive an email message from

 StartCom CertMaster <certmaster@startcom.org> <pre> containing your verification code; Copy it and go back to the starssl website where you should have a page requesting for that code. Paste in the verification code and hit "Continue", just like the following image: <a href="https://blog.giuseppeurso.net/?attachment_id=841" rel="attachment wp-att-841"><img src="https://blog.giuseppeurso.net/wp-content/uploads/2012/12/inserting_starssl_domain_name_verification_code-300x199.png" alt="This picture shows the Domain Name Verificatio final step on Starssl dot com" width="300" height="199" class="size-medium wp-image-841" /></a> Here is shown how to complete the Domain Name Verification process by verifying the code. Remember: you have 15 minutes until the verification code exipres. If so go back and re-do it quickly!Once you paste the correct code, you have finished and you should see a confirmation messages like the following image: <a href="https://blog.giuseppeurso.net/?attachment_id=842" rel="attachment wp-att-842"><img src="https://blog.giuseppeurso.net/wp-content/uploads/2012/12/Starssl_domain_name_validation_success-300x199.png" alt="This image shows the completed domain name verification process on starssl dot comprocess " width="300" height="199" class="size-medium wp-image-842" /></a> Picture showing the final step to the Domain Name Verification on starssl dot com At this point we will start generating our certificate file, selecting "CERTIFICATES WIZARD" from the three green tabs. Once there, you will be asked for the "Certificate Purpose" and you have to choose "Webserver SSL/TSL Certificate" from the drop-down menu as shown in the following picture: <a href="https://blog.giuseppeurso.net/?attachment_id=843" rel="attachment wp-att-843"><img src="https://blog.giuseppeurso.net/wp-content/uploads/2012/12/starssl_certificates_wizard_select_certificate_purpose-300x199.png" alt="This picture shows the first step getting the SSL free certificate from starssl " width="300" height="199" class="size-medium wp-image-843" /></a> This picture shows the first step getting the SSL free certificate from starssl After this, you will be asked to generate a new private key or use an existing CSR request: you want to use your existing one, remember the one generated with ISPConfig. So as shown in the following picture: just hist "SKIP". <a href="https://blog.giuseppeurso.net/?attachment_id=844" rel="attachment wp-att-844"><img src="https://blog.giuseppeurso.net/wp-content/uploads/2012/12/starssl_certificates_wizard_private_key_generation_skip_this_step-300x199.png" alt="Picture showing the step to be skipped in our setup process" width="300" height="199" class="size-medium wp-image-844" /></a> Picture showing the step to be skipped in our setup process In the next form we need to paste the CSR generated by ISPConfig at one of the first steps (the one called "SSL Request" on the ISpconfig Web Domain SSL panel). Just copy and paste it paying attention in order to NOT copy any other digit or blank spaces outside the two delimiters: <pre> -----BEGIN CERTIFICATE REQUEST----- 

and

 -----END CERTIFICATE REQUEST----- 

just like the following image:

Here is shown how to submit your CSR to the certificates wizard of starssl dot com

After submitting your CSR you will see the page show in the following image:

This page confirms you have correctly pasted and uploaded your CSR to starssldot com

Then Hit “CONTINUE” and in the next step you are asket to choose the “ROOT” domain name to generate the certificate for.
as shown here:

Here is shown the root domain selection during the certificate generation on starssl

Now it’s time to type wich subdomain will be covered from this certificate as well: here you could type just “www” to have the certificate working for example both on

 AND <pre> https://www.giuseppeurso.net 

OR

 https://blog.giuseppeurso.net 

As you can see from the following image, i typed test.blog as subdomain because i already have a certificate for blog.giuseppeurso.net so i can show you the complete steps.

You can see how to add subdomains for the FREE class2 starssl certificate

Now Starssl is ready to process your certificate request and it will confirm you the domain this certificate is going to work on:

Starssl ready to issue your certificate

Just Hit enter here.

POTENTIAL PROBLEM:
Should you see an “Additional Check Required” page, don’t worry, it is normal. It happends just when you generate 2 certificate for the very same root domain in a few hours (this is the second to me in a couple of hours). All you have to do this case is to seat back, relax and wait for the email wich will for sure confirm your certificate issuing.

Starssl additional check required

In this case, you should receive the email very soon (mine arrived in minutes) and it will tell you to retrieve your certificate from the control panel, so go to the starssl control panel, and then click on the first green tab called “Toolbox” and choose “RETRIEVE CERTIFICATE” as shown

Here is where to select and copy your certificate to your clipboard

INSTEAD IF ALL GOES FINE
You will be presented a page to copy the certificate file to be pasted into the “SSL Certificate” on ISPConfig ssl config page and to download the CA.pem to be pasted into the “SSL Bundle” textarea in the ISPConfig ssl panel. I don’t have this image because, as you know, i have had the Additional Check…
You can follow the remaining steps to complete the tutorial

---

Then you finally can paste your certificate into teh ISPConfig ssl admin page for your site as follows, and Remember: the content you find in “SSL Certificate” textbox already, is not necessary and HAS TO BE OVERWRITTER by new one

Here is shown how to update the certificate within ispconfig

Now save and finally let’s take the next and final step!
This will consist of adding the Certification Authority to our setup
You should already saved it when downloaded from startssl, so let’s open it, and copy the full content to your clipboard. If you didn’t already get it, you can find it in the Starssl Toolbox, under the menu “StartCom CA Certificates” and you should download the ca.pem by clicking on “StartCom Root CA”. Once downloaded, open it, select all and copy the full content, paying attention to the delimiters (see up in the post) and finally paste it into the ISPConfig ssl tab in the “SSL Bundle” textbox, as follow

This image shows the final step of adding CA.pem to the ISPConfig3 WebDomain SSL configuration.

Now all you have to do is to wait some minutes to let ISPConfig do its stuff and then, you can go on your browser and type “https://test.blog.giuseppeurso.net” in the address bar, obviously replacing my domain with yours, to see if all works. If all went fine you should see:

SSL certificate working

Hope this will help
Ciao!!

How to Add An SSL Certificate to an Ispconfig website with Starssl