Changes between Version 16 and Version 17 of Documentation/Community/HowTo/ZarafaSetupWithOutlookThunderbirdSync

Timestamp:

02/07/12 00:41:55 (16 months ago)

Author:

bbking (IP: 213.235.204.99)

Comment:

a more detailed explanation of the certificate installation

Documentation/Community/HowTo/ZarafaSetupWithOutlookThunderbirdSync

@@ -2 +2 @@
 Author(s): BBKing[[BR]]
 Date: 02 Oct 2011[[BR]]
-Version(s): 2.0[[BR]]
+Version(s): 2.0, 2.2[[BR]]
 Zentyal profiles: Zarafa [[BR]]
 
@@ -181 +181 @@
 I went to http://www.startssl.com and got my own, officially signed certificates for my Zentyal-Box. Here is a great howto (http://forum.zentyal.org/index.php/topic,616.msg2340.html#msg2340), regarding the installation of the signed certificates.
 
-I will quote Javier's howto here just to have all infos in one place:
-
-{{{
-#!div class=quote style="border: 2pt solid; text-align: left;background-color:#336699"
-- you cannot export your certificate in the CA module because you need a CA certificate to be able to issue other certificates
-
-- to use your certificate as the certificate for web administration, you must:
-  1) put the certificate in the file /var/lib/ebox/conf/ssl.crt/ebox.cert
- 2) put the certficate key file in the file /var/lib/ebox/conf/ssl.key/ebox.key
-  3)create the pem file concatening the two previous files, lke this:
-
-   cat  /var/lib/ebox/conf/ssl.crt/ebox.cert /var/lib/ebox/conf/ssl.key/ebox.key > /var/lib/ebox/conf/ssl.pem/ebox.pem
-  chmod 0400 /var/lib/ebox/conf/ssl.pem/ebox.pem
-
- 4) restart the webserver with:
-  /etc/init.d/ebox apache restart
-
-- to use your certficate in the mail server you need to proceed similarly:
-    1) put the certificate in the file /etc/postfix/sasl/smtpd.pem
- 2) put the certficate key file in the file /etc/postfix/sasl/smptd-key.pem
-  3)create the pem file concatenating the two previous files, lke this:
-
-   cat  /etc/postfix/sasl/smtpd.pem /etc/postfix/sasl/smtpd-key.pem > /etc/postfix/sasl/smtp.pem
-  chmod 0400 /etc/postfix/sasl/smtp.pem
-
- 4) restart the mail system with:
-  /etc/init.d/ebox mail restart
-
-}}}
-
-
-One remark: if you copy the .pem file created in step 2 to /etc/postfix/sasl/whatever.pem you don't have to repeat the steps later on.
-
-TODO: check whether the certificates are in place after a reboot.
-
-
+I will use Javier's howto here and append my remarks to it:[[BR]]
+[[BR]]
+
+At first, you have to understand, that there are 2 different Apache instances running. One is doing the normal webpages, the other one is serving the web admin pages. These instances have 2 different config files.
+
+Securing webpages (Zarafa's webaccess, Roundcube, etc.):[[BR]]
+1) put the certificate in the file /etc/apache2/ssl/ssl.cert[[BR]]
+2) put the certficate key file in the file /etc/apache2/ssl/ssl.key[[BR]]
+3) create the pem file concatening the two previous files, like this:[[BR]]
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+   cat /etc/apache2/ssl/ssl.cert /etc/apache2/ssl/ssl.key > /etc/apache2/ssl/ssl.pem[[BR]]
+   chmod 0400 /var/lib/ebox/conf/ssl.pem/ebox.pem
+}}}
+
+here I went over to the /usr/share/<ebox/zentyal>/stubs/webserver and added the following line to default-ssl.mas :[[BR]]
+
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+SSLCertificateChainFile "/etc/apache2/ssl/sub.class1.server.ca.pem"
+}}}
+
+the sub.class1.server.ca.pem is issued by StartSSL, this will tell the browser who is the CA.[[BR]]
+
+Do a [[BR]]
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+/etc/init.d/zentyal webserver restart
+}}}
+and your official certificates should be working.[[BR]]
+
+Securing the admin interface:[[BR]]
+1) put the certificate in the file /var/lib/ebox|zentyal/conf/ssl/ssl.cert[[BR]]
+2) put the certficate key file in the file /var/lib/ebox|zentyal/conf/ssl/ssl.key[[BR]]
+3) create the pem file concatening the two previous files, like this:[[BR]]
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+   cat  /var/lib/ebox|zentyal/conf/ssl/ssl.cert /var/lib/ebox|zentyal/conf/ssl/ssl.key > /var/lib/ebox|zentyal/conf/ssl/ssl.pem[[BR]]
+   chmod 0400 /var/lib/ebox/conf/ssl.pem/ebox.pem
+}}}
+
+TODO: verify inserting official CA[[BR]]
+
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+/etc/init.d/zentyal apache restart
+}}}
+
+will restart you admin interface, which will have the official certificates as well.[[BR]]
+
+Securing IMAP with an official certificate:[[BR]]
+
+1) put the certificate in the file /etc/postfix/sasl/smtpd.pem (Zentyal 2.0 or Ebox) or /etc/postfix/sasl/postfix.pem [[BR]]
+Create the .pem file according to above.[[BR]]
+2) restart the mail system with:[[BR]]
+{{{
+#!div class=conf style="border: 2pt solid; text-align: left;background-color:#AAAAAA"
+/etc/init.d/zentyal mail restart
+}}}
+
+TODO: check whether the certificates are in place after a reboot. Explain the use of hooks.[[BR]]
+
+
+