Now that letsencrypt.org entered public beta, I took the opportunity to use their fantastic service and deploy a new site certificate for madnet.ch and the other sites hosted on this platform.
The letsencrypt client was a bit confusing first but after I understood what the ACME protocol actually means, I saw the entire beauty behind this solution. So I did a quick review of the code in Github and shortly after I requested the first certificate. As I already have an Apache server running and don’t need the embedded web server stuff provided by the letsencrypt client, I only use the CSR and certificate download part of the client.
After a while I figured out how to request proper alternate subject names as well and was finally able to secure all the services running on madnet.ch with only a single certificate deployed to my Apache.
To request/renew a certificate for different hosts/domains, you basically just do:
letsencrypt-auto certonly \
-w /home/to/htdocs/madnet.ch/ \
-d www.madnet.ch \
-d madnet.ch \
-d mail.madnet.ch \
-w /home/to/htdocs/anothersite/ \
-d www.anothersite.ch \
I also took the chance to improve the SSL configuration of my Apache web server considering recommendations from SSLLabs
After an upgrade to Apache 2.4.18, generating a proper DH parameter file and append it to the letsencrypt certificate chain, SSLLabs rates us with an A+.
Apache 2.4 SSL configuration (ssl-global.conf)
# Added dhparams to fullchain.pem
# If you have different certificates per vhost,
# add these to your vhost config instead
SSLProtocol All -SSLv2 -SSLv3
SNI enabled virtual host configuration
# Strict Transport Security per virtual host
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
I run a SuSE 11 internet server providing some basic services.
I recently had to upgrade to a new version of SuSE (11.3) and it took my quite some time to do so.
Therefore I am listing here the necessary steps, hoping that the next time I will spend less time on such an upgrade…
- dovecot IMAP/IMAPS Mail Server
- dovecot POP3/POP3S Mail Server
- postfix SMTP TLS MTA
- Apache HTTP/HTTPs Webserver
- Subversion Repository
- WebDAV online Disk
- BIND DNS
Preparations and basic setup
- Take the server off-line and make sure no mail arrives. The emails will be queued on the alternate MX and delivered later.
- Do the backup (
rsync including all deletions)
- Dump the installed packes to an XML using
yast2 Software Management
- Install base software from boot ISO over the network
- Setup Networking
/home in the background
Setup Mail Server
- Setup postfix (check possibility to restore
/etc/sysconfig/postfix from backup), but do not start
- Setup dovecot (restore
/etc/dovecot/dovecot.conf), but do not start
- Check certificate values in
/etc/sysconfig/postfix (or restore from backup)
- Create postfix certificates and SSL CA using
- Edit the config file
/usr/share/doc/packages/dovecot/dovecot-openssl.cnf (attention, will be overwritten when upgrading dovecot)
- Download and install roundcube mail in
Setup Apache Webserver
- Setup apache2 (check possibility to restore
/etc/apache2/vhost.d from backup
/etc/apache2/conf.d/subversion.conf from backup
- Generate the following certificates for apache using
yast2 (mail, svn, disk)
- Export the PEM encoded certificates to
Setup BIND Name Server
/etc/named.conf from backup
/etc/named.d from backup
/var/lib/named/master from backup
/etc/my.cnf from backup
/var/lib/mysql from backup
- If subversion is the same version (or compatible) just restore /srv/svn from backup
- If subversion is not compatible anymore use
svnadmin load to load the dump from the backup
There’s noting to do for the WebDAV disk 🙂
After all the configuration files etc. have been restored and the settings in
/etc/sysconfig have been checked, run SuSEconfig for the last time and test the mail server.
Unplug from the internet and start postfix and dovecot.
Check if a locally created mail is correctly handled by postfix, amavis and successfully delivered with dovecot.
Also check if the IMAP mbox is created in
If this test succeeds we can restore
/var/spool/mail from backup and connect to the internet again.
yast2 to edit the runlevel configuration and make sure all the services are started at boot-time.
Also start them now.
Stored e-mails should no be delivered and correctly handled by the mail server.
Test all the virtual apache servers, webmail, subversion and WebDAV.