SLL certifying sambar

[Chronamut]

hey guys, so I have been scratching my head trying to get this to work.

I use register.com to get my domain server name - I used this documentation from sambar to try to set it up:

http://wiesweg.no-ip.org:8080/syshelp/ssl.htm

my site is chronriddles.com

so let's break it down:

I used opensll in /bin to create the 2048 key as register.com requires 2048 not 1024:

openssl genrsa -rand randfile -out key.pem 2048

I then moved it to the config folder.

I then generated the csr:

openssl req -new -key key.pem -out req.pem -config ..\config\openssl.cnf

filled in all the attributes I needed to.

I then took the resulting certificate request code and sent it to register.com.

They verified and I was given 2 files:

chronriddles.crt: my primary certificate I am assuming
RSADomainValidationSecureServerCA.crt would be my intermediate certificate I guess.

now I don't know what to do at this point.

I changed the https to true in the config. I tried combining both files together and renaming them cert.pem as the instructions say to do that - but then I thought maybe it has something to do with certificate chain files like is mentioned so I tried to fun that string but got an error (i pointed it to congif).

openssl x509 -inform DES -in ca-bundle.crt -out ca-bundle.pem -text

(after moving ca-bundle.pem to try that)

or

openssl x509 -inform DES -in ..\config\ca-bundle.crt -out ca-bundle.pem -text

or

openssl x509 -inform DES -in ..\config\ca-bundle.crt -out ..\config\ca-bundle.pem -text


that gave me 2 errors regardless of what I tried:

7556:error:0D0680A8: asn1 encoding routines: ASN1_CHECK_TLEN: wrong tag: .\crypto\asn1\tasn_dec.c:1294:
7556:error:0D07803A: asn1 encoding routines: ASN1_ITEM_EX_D2I:nested asn1 error:.\crypto\asn1\tasn_dec.c:380:Type=X509

when I tried to run my site it tells me I have a cypher mismatch - so I don't know what I am doing wrong - any help would be greatly appreciated. Do I have to add anything to ca-bundle.crt? How do I get both crt files I received to be seen as cert.pem? Do they have to be combined, or do I have to ru nthe openssl one for certificate chain files?Very confusing..

thanks!

-shawn-

[Johannes]

Hi there,

first, the supplied openssl is way to old
secondly, Sambar can not handle the new OpenSSL 1.1.0. The last one which works with Sambar is Openssl1.0.2

If you want to run your site with https, you need to run Apache or Nginx as SSL proxy in front of Sambar. This way all incoming SSL traffic will stop at the proxy and http traffic will than be forwarded to Sambar.

I am working myself on that right now and be half way through. Working on Debian though.

Johannes

[Chronamut]

hey there!

I actually solved the problem and bypassed sambar completely by using cloudflare to https certify it through my domain that i superimposed on sambar - it works and it shows as https

https://chronriddles.com

[Steffen]

[Johannes]

Hi Steffen,

exactly, that is what I want to set up. But as I need STARTTLS for my Sambar Mail, I found out that Nginx can handle mail protocol too as Reverse Proxy.
So will set this up with Nginx to have all covered.

Will let you guys know how this will work, when done.

Johannes

[Johannes]

[Steffen]

See the discussion about the IP at https://www.apachelounge.com/sambar/viewtopic.php?t=644

I cannot get that the IP is showing up in the logs, only as ENV var for example PHP:

PHP info:

HTTP_X_FORWARDED_SERVER www.land10web.com
HTTP_X_FORWARDED_HOST land10web.com
HTTP_X_FORWARDED_FOR 80.101.236.247

[Johannes]

Hi Steffen,

thank you.

That is in the right direction and I will have to use that already for for one custom form with sambar scripting which I currently have.

As far as the logs go, I did a little "fooling". Disabling the log files in Sambar (Sambar will not write the log files) instead, I created a link from the Nginx access log for the particular domain to the log directory in Sambar. Can read now the "original" Nginx logs as it was done by Sambar from the Sambar Admin area.

If you are interested to view the visitors IP from the Sambar Admin area, you could do just the same with Apache's logs.

Johannes